# Metricbeat process metricset fails to run

**URL:** <https://discuss.elastic.co/t/metricbeat-process-metricset-fails-to-run/150498>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [October 1, 2018, 2:23am UTC](https://discuss.elastic.co/t/metricbeat-process-metricset-fails-to-run/150498 "2018-10-01T02:23:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![koko191](https://avatars.discourse-cdn.com/v4/letter/k/a587f6/32.png) [@koko191](https://discuss.elastic.co/u/koko191)\
**Post date:** [October 1, 2018, 2:23am UTC](https://discuss.elastic.co/t/metricbeat-process-metricset-fails-to-run/150498/1 "2018-10-01T02:23:10Z")

</div>

Some context on my issue: I am trying to run Metricbeat as a service on a Windows machine. Metricbeat was installed using Chocolatey and the Metricbeat service was also installed using the script from Chocolatey.

These are the modules enabled in Metricbeat

```
metricbeat.modules:
- module: system
  metricsets:
	- process
  enabled: true
  period: 10s
  processes: ['.*']

  cpu.metrics: ["percentages"]
  core.metrics: ["percentages"]

- module: windows
  metricsets: ["service"]
  enabled: true
  period: 10s

```

So when I run Metricbeat manually on Windows using `metricbeat.exe -e -c metricbeat.yml`, everything works fine. However, when I run it as a service, the process metricset was not working. I get a bunch of "could not get Win32\_Process" error. Here's one such line of log

```
2018-09-30T19:08:03.415-0700	ERROR	process/process.go:454	Error getting process details. pid=1080: error getting process arguments for pid=1080: ProcArgs failed for pid=1080: could not get Win32_Process WHERE ProcessId = 1080: Class does not exist.

```

And the log file was bombarded with these log lines just 5 seconds after the service starts. So the question is, why does this happen only when I run Metricbeat as a service and how can I fix it?

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [October 2, 2018, 8:24pm UTC](https://discuss.elastic.co/t/metricbeat-process-metricset-fails-to-run/150498/2 "2018-10-02T20:24:59Z")

</div>

Hi,

Which version of metricbeat are you using?

Also, could you run the following Powershell command and share what it returns? Replace the process ID with one that's giving you the error in Metricbeat.

```auto
PS C:\Users\me > Get-WmiObject -Query "select * from win32_process where ProcessId=1080" | Format-List

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2018, 8:28pm UTC](https://discuss.elastic.co/t/metricbeat-process-metricset-fails-to-run/150498/3 "2018-10-30T20:28:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.