Limit records in windows perfmon

Elastic Stack Beats
1

Can I get top N records from windows perfmon ordered by value descending? I don't want to store all records.

windows.yml:

- module: windows
  metricsets: ["perfmon"]
  period: 10s
  perfmon.counters:      
    - instance_label: "process.name"
      measurement_label: "process.cpu"
      query: '\Process(*)\% Processor Time'
      format: "float"
      # TOP N ordered by value descending

Thanks.

2

This is not supported by the perfmon module. Only the system process metricset has a "top-N" feature. See https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-process.html.

3

Andrew, thanks for reply!