Recent studies have explored the potential of Machine Learning (ML) for intrusion detection systems (IDS) in the Internet of Things (IoT) system. However, low latency and privacy requirements are important in emerging application scenarios. Furthermore, due to limited communication resources, sending the raw data to the central server for model training is no longer practical. It is difficult to get labeled data because data labeling is expensive in terms of time. In this paper, we develop a semi-supervised federated active learning for IDS, called (METALS). This model takes advantage of Federated Learning (FL) and Active Learning (AL) to reduce the need for a large number of labeled data by actively choosing the instances that should be labeled and keeping the data where it was generated. Specifically, FL trains the model locally and communicates the model parameters instead of the raw data. At the same time, AL allows the model located on the devices to automatically choose and label part of the traffic without involving manual inspection of each training sample. Our findings demonstrate that METALS not only achieve a high classification performance, comparable to the classical FL model in terms of accuracy but also with a small amount of labeled data.