Hi Ryan,
Your post gave me the idea to put my hands back on this metricbeat subject.
In the past I wasn't able to have 1 single document with all the metrics for NTDS.
With the 7.x metricbeat agent version, I was able to make it working as I wanted.
So here is the 'complete' config file 'windows.yml' with all the NTDS counters found on a 2012r2 DCs and metricbeat agent 7.4.2.
I use "instance_name" NTDS to have all counters in 1 document.
You can add counters for CPU/Memory/Network ... on the same instance name or use another instance name if you prefer to have seperate documents for different category of counters.
I put some examples with some DNS and System Counters, with this config file , you will have 3 documents per pull per metricbeat agent.
Note : 1 counter is not pulled, and doesn't seem to be working on the server "DRA Threads Getting NC Changes Holding Semaphore".
It's NOT related to metricbeat, but to the OS itself (this behavior happens on other counters like DNS).