From e39b3474636e390b58ea8e2779e1fd796b20b81f Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Mon, 22 May 2017 15:03:39 -0400
Subject: [PATCH] Filter relative mounts in system filesystem metricset (#4370)

Add filtering to system filesystem metricset to remove relative mountpoints like those from Linux network namespaces.
---
 CHANGELOG.asciidoc                            |  2 +
 .../module/system/filesystem/filesystem.go    |  2 +-
 metricbeat/module/system/filesystem/helper.go | 48 ++++++-------------
 3 files changed, 17 insertions(+), 35 deletions(-)

diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index b7f60fee3880..cae2d283a292 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -44,6 +44,8 @@ https://github.com/elastic/beats/compare/v6.0.0-alpha1...master[Check the HEAD d
 - Fix a debug statement that said a module wrapper had stopped when it hadn't. {pull}4264[4264]
 - Use MemAvailable value from /proc/meminfo on Linux 3.14. {pull}4316[4316]
 - Fix panic when events were dropped by filters. {issue}4327[4327]
+- Add filtering to system filesystem metricset to remove relative mountpoints like those
+  from Linux network namespaces. {pull}4370[4370]
 
 *Packetbeat*
 
diff --git a/metricbeat/module/system/filesystem/filesystem.go b/metricbeat/module/system/filesystem/filesystem.go
index 4cf3cc5c1b16..24426db8bb12 100644
--- a/metricbeat/module/system/filesystem/filesystem.go
+++ b/metricbeat/module/system/filesystem/filesystem.go
@@ -11,7 +11,7 @@ import (
 	"github.com/pkg/errors"
 )
 
-var debugf = logp.MakeDebug("system-filesystem")
+var debugf = logp.MakeDebug("system.filesystem")
 
 func init() {
 	if err := mb.Registry.AddMetricSet("system", "filesystem", New, parse.EmptyHostParser); err != nil {
diff --git a/metricbeat/module/system/filesystem/helper.go b/metricbeat/module/system/filesystem/helper.go
index c1e93909954b..ca1ddaf4142b 100644
--- a/metricbeat/module/system/filesystem/helper.go
+++ b/metricbeat/module/system/filesystem/helper.go
@@ -3,10 +3,10 @@
 package filesystem
 
 import (
+	"path/filepath"
 	"time"
 
 	"github.com/elastic/beats/libbeat/common"
-	"github.com/elastic/beats/libbeat/logp"
 	"github.com/elastic/beats/metricbeat/module/system"
 	sigar "github.com/elastic/gosigar"
 )
@@ -20,13 +20,23 @@ type FileSystemStat struct {
 }
 
 func GetFileSystemList() ([]sigar.FileSystem, error) {
-
 	fss := sigar.FileSystemList{}
-	err := fss.Get()
-	if err != nil {
+	if err := fss.Get(); err != nil {
 		return nil, err
 	}
 
+	// Ignore relative mount points, which are present for example
+	// in /proc/mounts on Linux with network namespaces.
+	filtered := fss.List[:0]
+	for _, fs := range fss.List {
+		if filepath.IsAbs(fs.DirName) {
+			filtered = append(filtered, fs)
+			continue
+		}
+		debugf("Filtering filesystem with relative mountpoint %+v", fs)
+	}
+	fss.List = filtered
+
 	return fss.List, nil
 }
 
@@ -54,26 +64,6 @@ func AddFileSystemUsedPercentage(f *FileSystemStat) {
 	f.UsedPercent = system.Round(perc, .5, 4)
 }
 
-func CollectFileSystemStats(fss []sigar.FileSystem) []common.MapStr {
-	events := make([]common.MapStr, 0, len(fss))
-	for _, fs := range fss {
-		fsStat, err := GetFileSystemStat(fs)
-		if err != nil {
-			logp.Debug("system", "Skip filesystem %d: %v", fsStat, err)
-			continue
-		}
-		AddFileSystemUsedPercentage(fsStat)
-
-		event := common.MapStr{
-			"@timestamp": common.Time(time.Now()),
-			"type":       "filesystem",
-			"fs":         GetFilesystemEvent(fsStat),
-		}
-		events = append(events, event)
-	}
-	return events
-}
-
 func GetFilesystemEvent(fsStat *FileSystemStat) common.MapStr {
 	return common.MapStr{
 		"device_name": fsStat.DevName,
@@ -89,13 +79,3 @@ func GetFilesystemEvent(fsStat *FileSystemStat) common.MapStr {
 		},
 	}
 }
-
-func GetFileSystemStats() ([]common.MapStr, error) {
-	fss, err := GetFileSystemList()
-	if err != nil {
-		logp.Warn("Getting filesystem list: %v", err)
-		return nil, err
-	}
-
-	return CollectFileSystemStats(fss), nil
-}