{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/6271","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/6271/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/6271/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/6271/events","html_url":"https://github.com/elastic/beats/issues/6271","id":294068504,"number":6271,"title":"Unexpectedly huge byte values returned for system.memory.swap.used.bytes","user":{"login":"ppf2","id":7216393,"avatar_url":"https://avatars0.githubusercontent.com/u/7216393?v=4","gravatar_id":"","url":"https://api.github.com/users/ppf2","html_url":"https://github.com/ppf2","followers_url":"https://api.github.com/users/ppf2/followers","following_url":"https://api.github.com/users/ppf2/following{/other_user}","gists_url":"https://api.github.com/users/ppf2/gists{/gist_id}","starred_url":"https://api.github.com/users/ppf2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ppf2/subscriptions","organizations_url":"https://api.github.com/users/ppf2/orgs","repos_url":"https://api.github.com/users/ppf2/repos","events_url":"https://api.github.com/users/ppf2/events{/privacy}","received_events_url":"https://api.github.com/users/ppf2/received_events","type":"User","site_admin":false},"labels":[{"id":331378892,"url":"https://api.github.com/repos/elastic/beats/labels/Metricbeat","name":"Metricbeat","color":"008000","default":false},{"id":78874872,"url":"https://api.github.com/repos/elastic/beats/labels/bug","name":"bug","color":"fc2929","default":true},{"id":219536313,"url":"https://api.github.com/repos/elastic/beats/labels/module","name":"module","color":"008000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-02-03T01:09:04Z","updated_at":"2018-03-26T21:52:30Z","closed_at":null,"author_association":"MEMBER","body":"6.1\r\n\r\nMetricbeat is returning ginormous byte values for swap used.  There are docker and kube processes running on this bare metal server (metricbeat is running directly on the host machine, not within containers).\r\n\r\n```\r\n[2018-01-31T17:07:47,804][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch.\r\n{\"type\"=>\"mapper_parsing_exception\", \"reason\"=>\"failed to parse [system.memory.swap.used.bytes]\", \"caused_by\"=>{\"type\"=>\"i_o_exception\", \"reason\"=>\"Numeric value (18446744070278606848) out of range of long (-9223372036854775808 - 9223372036854775807)\\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@45bfe490; line: 1, column: 342]\"}}}}}\r\n```\r\n\r\nWorkaround is to filter out fields using a processor with these large values.  If this is not something we can avoid because of golang, it will be nice for beats to filter these invalid values automatically without manual intervention.\r\n\r\nCentOS Linux release 7.4.1708 (Core)\r\n\r\n```\r\n free -m\r\n              total        used        free      shared  buff/cache   available\r\nMem:         257675        9188      244749          27        3737      247391\r\nSwap:          4083           0        4083\r\n```\r\n\r\n```\r\ntop - 10:38:10 up 3 days,  3:45,  4 users,  load average: 0.53, 0.70, 0.54\r\nTasks: 895 total,   1 running, 894 sleeping,   0 stopped,   0 zombie\r\n%Cpu(s):  0.7 us,  0.9 sy,  0.0 ni, 98.4 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st\r\nKiB Mem : 26385961+total, 25061606+free,  9416044 used,  3827500 buff/cache\r\nKiB Swap:  4182012 total,  4182012 free,        0 used. 25332158+avail Mem\r\n```"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/376324176","html_url":"https://github.com/elastic/beats/issues/6271#issuecomment-376324176","issue_url":"https://api.github.com/repos/elastic/beats/issues/6271","id":376324176,"user":{"login":"jsoriano","id":15763,"avatar_url":"https://avatars2.githubusercontent.com/u/15763?v=4","gravatar_id":"","url":"https://api.github.com/users/jsoriano","html_url":"https://github.com/jsoriano","followers_url":"https://api.github.com/users/jsoriano/followers","following_url":"https://api.github.com/users/jsoriano/following{/other_user}","gists_url":"https://api.github.com/users/jsoriano/gists{/gist_id}","starred_url":"https://api.github.com/users/jsoriano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsoriano/subscriptions","organizations_url":"https://api.github.com/users/jsoriano/orgs","repos_url":"https://api.github.com/users/jsoriano/repos","events_url":"https://api.github.com/users/jsoriano/events{/privacy}","received_events_url":"https://api.github.com/users/jsoriano/received_events","type":"User","site_admin":false},"created_at":"2018-03-26T21:52:30Z","updated_at":"2018-03-26T21:52:30Z","author_association":"MEMBER","body":"A similar issue has been reported in discuss (https://discuss.elastic.co/t/metricbeat-5-3-0-reporting-strange-memory-value/124825).\r\nI have been taking a look and the huge values are near maximum `uint64`. These \"used\" values are calculated as `Total - Free`, so it seems that in some circumstances, somehow, the found `Free` memory is bigger than the `Total`, leading to an integer overflow. I think this is something to investigate in gosigar."}}
{"actor":{"display_login":"jsoriano"}}