Monitor Container Disk I/O Operations

Track disk read and write operations across Docker containers

This is a query example for the Container Disk Block IO Read/Write Usage widget in the Docker Overview dashboard of the docker/metrics package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1>Augment Data] 2>Augment Data] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result
logscale
round(docker.diskio.read.bytes)
|round(docker.diskio.write.bytes)
|timechart(container.name, function=[avg(docker.diskio.read.bytes, as=diskread), avg(docker.diskio.write.bytes, as=diskwrite)])

Introduction

This widget is used to monitor disk I/O patterns across Docker containers by tracking read and write operations over time, helping identify containers with high disk activity and potential I/O bottlenecks.

In this widget, disk read and write bytes are rounded for clarity and displayed in a time-based chart. The timeChart() function aggregates the data by container, showing average I/O activity over time.

Example incoming data might look like this:

@timestamp#repo#type@id@ingesttimestamp@rawstring@timestamp.nanos@timezone@type_datagen_identifieragent.typeagent.versioncontainer.idcontainer.image.namecontainer.namedocker.container.event.actiondocker.container.event.actor.iddocker.container.event.fromdocker.container.event.statusdocker.container.event.typedocker.diskio.read.bytesdocker.diskio.read.opsdocker.diskio.summary.bytesdocker.diskio.summary.opsdocker.diskio.write.bytesdocker.diskio.write.opsdocker.event.actiondocker.healthcheck.event.end_datedocker.healthcheck.event.exit_codedocker.healthcheck.failingstreakdocker.healthcheck.statusdocker.image.createddocker.image.id.currentdocker.image.id.parentdocker.image.size.regulardocker.image.size.virtualdocker.image.tags[0]docker.info.containers.pauseddocker.info.containers.runningdocker.info.containers.stoppeddocker.info.containers.totaldocker.info.iddocker.info.imagesevent.datasetevent.modulehost.namemetricset.nameservice.type
2026-03-10T06:41:21auto-dashboard-queriesjsongtksp2dMmrYg9WSX5CeYyU5V_2_11_17731248812026-03-10T06:41:21{"docker.image.id.current":"sha256:abcd1234efgh5678","metricset.name":"image","docker.image.size.regular":"133169152","docker.image.created":"2026-03-10T06:41:21.002Z","event.module":"docker","docker.image.tags":["nginx:latest"],"@timestamp":"2026-03-10T06:41:21.002Z","host.name":"docker-host-01","agent.type":"metricbeat","@type":"docker","event.dataset":"docker.image","agent.version":"7.11.1","docker.image.size.virtual":"133169152","docker.image.id.parent":"sha256:parent1234567890ab","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240"}0Zdockerbbe9c9c08ebf329bc648a36a3991a240metricbeat7.11.1                   2026-03-10T06:41:21.002Zsha256:abcd1234efgh5678sha256:parent1234567890ab133169152133169152nginx:latest      docker.imagedockerdocker-host-01imagedocker
2026-03-10T06:41:21auto-dashboard-queriesjsongtksp2dMmrYg9WSX5CeYyU5V_2_12_17731248812026-03-10T06:41:22{"@timestamp":"2026-03-10T06:41:21.801Z","event.module":"docker","host.name":"docker-host-02","container.image.name":"nginx:latest","agent.type":"metricbeat","metricset.name":"event","docker.event.action":"stop","docker.container.event.action":"start","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.container.event.type":"container","docker.container.event.from":"redis:6.2-alpine","container.id":"a1b2c3d4e5f6","container.name":"nginx-web","event.dataset":"docker.event","docker.container.event.status":"Up 2 hours","@type":"docker","agent.version":"7.12.0","docker.container.event.actor.id":"b2c3d4e5f6a7"}0Zdockerbbe9c9c08ebf329bc648a36a3991a240metricbeat7.12.0a1b2c3d4e5f6nginx:latestnginx-webstartb2c3d4e5f6a7redis:6.2-alpineUp 2 hourscontainer      stop                docker.eventdockerdocker-host-02eventdocker
2026-03-10T06:41:22auto-dashboard-queriesjsongtksp2dMmrYg9WSX5CeYyU5V_2_13_17731248822026-03-10T06:41:23{"docker.info.containers.paused":"0","docker.info.images":"15","metricset.name":"info","docker.info.containers.running":"5","agent.type":"metricbeat","host.name":"docker-host-03","event.module":"docker","@timestamp":"2026-03-10T06:41:22.581Z","agent.version":"7.13.2","@type":"docker","event.dataset":"docker.info","docker.info.containers.stopped":"2","docker.info.containers.total":"7","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.info.id":"ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456"}0Zdockerbbe9c9c08ebf329bc648a36a3991a240metricbeat7.13.2                         0527ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:345615docker.infodockerdocker-host-03infodocker
2026-03-10T06:41:23auto-dashboard-queriesjsongtksp2dMmrYg9WSX5CeYyU5V_2_14_17731248832026-03-10T06:41:24{"container.id":"c3d4e5f6a7b8","container.name":"redis-cache","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.healthcheck.failingstreak":"0","@type":"docker","event.dataset":"docker.healthcheck","agent.version":"7.14.0","agent.type":"metricbeat","container.image.name":"postgres:14","event.module":"docker","@timestamp":"2026-03-10T06:41:23.389Z","host.name":"swarm-manager-01","docker.healthcheck.status":"healthy","docker.healthcheck.event.end_date":"2026-03-10T06:41:23.389Z","metricset.name":"healthcheck","docker.healthcheck.event.exit_code":"0"}0Zdockerbbe9c9c08ebf329bc648a36a3991a240metricbeat7.14.0c3d4e5f6a7b8postgres:14redis-cache            2026-03-10T06:41:23.389Z00healthy            docker.healthcheckdockerswarm-manager-01healthcheckdocker
2026-03-10T06:41:24auto-dashboard-queriesjsongtksp2dMmrYg9WSX5CeYyU5V_2_15_17731248842026-03-10T06:41:24{"container.id":"d4e5f6a7b8c9","container.name":"postgres-db","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","docker.diskio.read.ops":"125","docker.diskio.read.bytes":"1048576","docker.diskio.summary.bytes":"3145728","@type":"docker","event.dataset":"docker.diskio","docker.diskio.write.bytes":"2097152","agent.version":"7.15.1","docker.diskio.write.ops":"234","agent.type":"metricbeat","container.image.name":"mongo:5.0","event.module":"docker","@timestamp":"2026-03-10T06:41:24.187Z","host.name":"swarm-worker-01","docker.diskio.summary.ops":"359","metricset.name":"diskio"}0Zdockerbbe9c9c08ebf329bc648a36a3991a240metricbeat7.15.1d4e5f6a7b8c9mongo:5.0postgres-db     104857612531457283592097152234                 docker.diskiodockerswarm-worker-01diskiodocker

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1>Augment Data] 2>Augment Data] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    round(docker.diskio.read.bytes)

    Rounds the values in docker.diskio.read.bytes and returns the results in the same field.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1>Augment Data] 2>Augment Data] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    |round(docker.diskio.write.bytes)

    Rounds the values in docker.diskio.write.bytes, and returns the results in the same field.

  4. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1>Augment Data] 2>Augment Data] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    |timechart(container.name, function=[avg(docker.diskio.read.bytes, as=diskread), avg(docker.diskio.write.bytes, as=diskwrite)])

    Creates a timechart grouping by container.name, calculating average read and write bytes, and returns the results in diskread and diskwrite fields for each time period.

  5. Event Result set.

Summary and Results

The widget is used to monitor disk I/O patterns of Docker containers, helping identify containers with high disk activity and potential performance bottlenecks.

This widget is useful to track disk usage patterns, identify I/O-intensive containers, and plan capacity based on actual disk utilization.

Sample output from the incoming example data:

_bucketcontainer.namediskreaddiskwrite
1773124200000postgres-db3407872068157440
1773124200000prometheus-monitor  
1773124200000rabbitmq-queue  
1773124200000redis-cache  
1773124200000worker-01  

The output displays time-bucketed disk I/O data with diskread and diskwrite values for different containers, where postgres-db shows significant disk activity with approximately 34MB read and 68MB write operations.