[filebeat] Wrong "gc_overhead" parsed by Elasticsearch module

[tsouza]

Version: 6.5.3

The Elasticsearch Filebeat module will parse the following GC log message:

[2018-12-07T16:10:41,612][WARN ][o.e.m.j.JvmGcMonitorService] [node1] [gc][238436] overhead, spent [650ms] collecting in the last [1s]

Into a document that has:

{
  "elasticsearch": {
    "server": {
      "component": "o.e.m.j.JvmGcMonitorService",
      "gc_overhead": "238436"
    },
    "node": {
      "name": "node1"
    }
  }
}

There are a couple of issues here:

1. The value for field elasticsearch.server.gc_overhead is coming from [gc][238436] overhead. According to this https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/monitor/jvm/JvmGcMonitorService.java#L309 the number 238436 is just a sequential number that holds no significant meaning in GC timings. This is not the GC overhead
2. It does not collects the two important time components from this log message present in: spent [650ms] collecting in the last [1s]

[BobBlank12]

This was created in filebeat version 6.4.3

[elasticmachine]

Pinging @elastic/infrastructure

[elasticmachine]

Pinging @elastic/stack-monitoring

[ycombinator]

@tsouza Thanks for reporting this. I'm working on a fix now.

When looking at the parsed document for spent [650ms] collecting in the last [1s], what field names would make most sense to you for the 650ms and 1s values?

[ycombinator]

@tsouza Regarding my question in the previous comment, let's continue the conversation on the PR (#9603) where I made up some strawman field names.