# MetricBeat - Perfmon Counters **URL:** \ **Category:** Beats\ **Created:** [January 19, 2018, 2:57am UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150 "2018-01-19T02:57:55Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 19, 2018, 2:57am UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/1 "2018-01-19T02:57:55Z")
Been playing with the ELK stack pretty heavily the last week or so running on a Windows platform. I'd like to collect per CPU metrics and have them display on a time series. This is what I have in the windows.yml module config for 8 cores: - instance\_label: "core.0" instance\_name: "Core 0" measurement\_label: "processor.time.core.0" query: '\Processor Information(0,0)% Processor Time' In Kibana, after refreshing my index, I see windows.perfmon.core.0 and windows.perfmon.core.0.keyword. In the Discover tab, I see those as selectable fields but they're all empty. Question: 1. I don't want both core.0 and core.0.keyword, how do I get rid of one of them? a. Would it be recommended to keep the one that is aggregatable? 2. What else needs to be done to get the data that is collected to properly display? ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [January 23, 2018, 2:44pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/2 "2018-01-23T14:44:18Z")
Which version of MB do you have? I suspect you didn't load the MB template, because our default template defines all string fields as `keyword`, so there shouldn't be two fields created. The Metricbeat template should be loaded automatically when connecting to ES, so tell me more about your setup please. Is MB sending data directly to ES? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 23, 2018, 3:22pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/3 "2018-01-23T15:22:23Z")
We are using MetricBeat 6.1.1 and it sends data to LogStash, which then sends the data over to ElasticSearch. ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [January 23, 2018, 8:38pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/4 "2018-01-23T20:38:35Z")
In that case, you need to manually load the template to Elaticsearch. See the docs [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html#load-template-manually). Because you already have indices created, safest is to delete them (i.e. `DELETE /metricbeat-*`) before loading the mapping template. ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 24, 2018, 2:14am UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/5 "2018-01-24T02:14:32Z")
Alright, I deleted my metricbeat indices, manually loaded the templates and have single entries for each perfmon counter I have specified. It's been about 30 minutes but I am still not getting any data aligned with those fields in the Discover section of Kibana. Is there something else I need to configure? Below is what I am seeing as well as the windows.yaml and windows module status ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/8/3/836f16cbcb1cf3d573f951a2d9b37f6347b505c2.PNG) ![Capture1](https://us1.discourse-cdn.com/elastic/original/3X/6/3/63dd5a135d2efd13284e4826295989175dfb45b0.PNG): ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [January 24, 2018, 9:53am UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/6 "2018-01-24T09:53:52Z")
Can you expand one of those events for me to see how it looks like? You can also start Metricbeat with the `-d "publish"` flag, in which case Metricbeat will print the created events at the console. This might speed up the troubleshooting: ```auto .\metricbeat.exe -e -d "publish" ``` ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 24, 2018, 4:47pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/7 "2018-01-24T16:47:40Z")
![output](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c0fd2cc3e828ff35e8ede6cf49323fc8b3671dcc.PNG) ![expand](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc52c4e433f06016318cc042a1c1204333a66fd2.PNG) ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 26, 2018, 3:23pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/8 "2018-01-26T15:23:01Z")
Anybody got anything? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2018, 2:58am UTC](https://discuss.elastic.co/t/metricbeat-perfmon-counters/116150/9 "2018-02-09T02:58:38Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.