MetricBeat - Perfmon Counters

wwalker · January 19, 2018, 2:57am

Been playing with the ELK stack pretty heavily the last week or so running on a Windows platform. I'd like to collect per CPU metrics and have them display on a time series. This is what I have in the windows.yml module config for 8 cores:

instance_label: "core.0"
instance_name: "Core 0"
measurement_label: "processor.time.core.0"
query: '\Processor Information(0,0)% Processor Time'

In Kibana, after refreshing my index, I see windows.perfmon.core.0 and windows.perfmon.core.0.keyword. In the Discover tab, I see those as selectable fields but they're all empty. Question:

I don't want both core.0 and core.0.keyword, how do I get rid of one of them?
a. Would it be recommended to keep the one that is aggregatable?
What else needs to be done to get the data that is collected to properly display?

tudor · January 23, 2018, 2:44pm

Which version of MB do you have? I suspect you didn't load the MB template, because our default template defines all string fields as keyword, so there shouldn't be two fields created.

The Metricbeat template should be loaded automatically when connecting to ES, so tell me more about your setup please. Is MB sending data directly to ES?

wwalker · January 23, 2018, 3:22pm

We are using MetricBeat 6.1.1 and it sends data to LogStash, which then sends the data over to ElasticSearch.

tudor · January 23, 2018, 8:38pm

In that case, you need to manually load the template to Elaticsearch. See the docs here.

Because you already have indices created, safest is to delete them (i.e. DELETE /metricbeat-*) before loading the mapping template.

wwalker · January 24, 2018, 2:14am

Alright, I deleted my metricbeat indices, manually loaded the templates and have single entries for each perfmon counter I have specified. It's been about 30 minutes but I am still not getting any data aligned with those fields in the Discover section of Kibana. Is there something else I need to configure? Below is what I am seeing as well as the windows.yaml and windows module status

:

tudor · January 24, 2018, 9:53am

Can you expand one of those events for me to see how it looks like? You can also start Metricbeat with the -d "publish" flag, in which case Metricbeat will print the created events at the console. This might speed up the troubleshooting:

.\metricbeat.exe -e -d "publish"

wwalker · January 24, 2018, 4:47pm

wwalker · January 26, 2018, 3:23pm

Anybody got anything?

system · February 9, 2018, 2:58am

This topic was automatically closed after 21 days. New replies are no longer allowed.