List all known mountpoints in filesystem events

[jsoriano]

After https://github.com/elastic/beats/pull/6819, the filesystem metricset collects one event per mounted filesystem. If the filesystem is mounted several times only one event is generated per filesystem. This is intended to avoid data duplication as this metricset is intended to report metrics of filesystems. The mount point reported is the shortest one. The problem with this approach is that there are mount points that are not reported.

Something we could do to avoid this is to report all the known mountpoints instead of only the shortest one, this could be done by generating the event with a list of mountpoints instead of a single value, this wouldn't be breaking as the type of the field would still be keyword.

For example a resulting event would have fields like this:

    "system": {
        "filesystem": {
            ...
            "device_name": "/dev/dm-1",
            "mount_point": ["/var/log", "/etc/hosts"]
            "type": "xfs",
            ...
            }
        }
    }

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[qqqasdwx]

Has this problem been solved?

[groge]

I have the same problem after moved docker's default directory. host:/srv directory mapped /etc/hosts on container. [host : df -h] [container: df -h] I'm using metricbeat:6.3.2

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[qqqasdwx]

I saw that this problem was marked as stale, but no one told me that this problem has been fixed. Has this problem been fixed now?

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!