Error fetching data for metricset windows.service: The data is invalid

[adrianbumbas]

Hello

I'm trying to get Windows metrics using Metricbeat 7.6.0 and all I get in the logs is this message:

Error fetching data for metricset windows.service: The data is invalid.

The user under which I'm running Metricbeat is a local administrator and I can manage services without issu, the OS is Windows Server 2012 R2 Standard.
The metricbeat.yml config looks like this:

- module: windows
  metricsets:
  - service
  period: 1m

Here is the full JSON message send by Metricbeat:

{
"@timestamp": "2020-03-04T12:51:50.868Z",
"@metadata": {
  "beat": "metricbeat",
"type": "_doc",
"version": "7.6.0"
},
"agent": {
"id": "8a19eb30-924a-477a-bc09-69092dcad8c2",
"version": "7.6.0",
"type": "metricbeat",
"ephemeral_id": "74e6de13-aafa-49f3-8084-3f0d45f1f309",
"hostname": "x"
},
"event": {
"dataset": "windows.service",
"module": "windows",
"duration": 17997900
},
"metricset": {
"period": 60000,
"name": "service"
},
"service": {
"type": "windows"
},
"error": {
"message": "The data is invalid."
},
"ecs": {
"version": "1.4.0"
},
"host": {
"id": "ce499e1c-7cc3-4bd9-a800-938fccb31cb8",
"name": "x",
"hostname": "x",
"architecture": "x86_64",
"os": {
  "platform": "windows",
  "version": "6.3",
  "family": "windows",
  "name": "Windows Server 2012 R2 Standard",
  "kernel": "6.3.9600.19629 (winblue_ltsb_escrow.200127-1700)",
  "build": "9600.19629"
}
}
}

What could be the issue?

Thanks

[MarianaD]

hi @adrianbumbas , I am not able to reproduce this scenario on the same OS at the moment. Can you enable debug logging and let us know if more information is found there, also can you check in the Event Viewer if this error is logged there as well.
The error message is most likely coming from the win api https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-enumservicesstatusexw we use to retrieve the metric values.

[adrianbumbas]

Hi @MarianaD. To enable debug output which is the selector i need to use?

[MarianaD]

hi @adrianbumbas, you can either run:

metricbeat -e -d "*"

and send us any interesting snippets from the console output or set the debug level in the logs and provide us more info from the metricbeat.log files:
set in the metricbeat.yml file:

logging.level: debug

[adrianbumbas]

All I can see in the logs is this

INFO	module/wrapper.go:252	Error fetching data for metricset windows.service: The data is invalid.