Metricbeat Windows Module 6.0.0-alpha2, Output question

Elastic Stack Beats
1

Hi Everyone,

was since yesterday starting to test the alpha of the new windows module to use perfmon data to get a better overview of our .Net applications within IIS.

Now is only one big remaining question mark over my head :smiley:

in the config i provide different names to separate each query from perfmon:

  • module: windows
    metricsets: ["perfmon"]
    period: 10s
    perfmon.counters:
    • instance_label: "example.com cache api entries"
      instance_name: "LM_W3SVC_2_ROOT"
      measurement_label: "cache.api.entries"
      alias: "cache.api.entries"
      query: '\ASP.NET Apps v4.0.30319(_LM_W3SVC_2_ROOT)\Cache API Entries'
    • instance_label: "example.com cache api hit ratio"
      instance_name: "LM_W3SVC_2_ROOT"
      measurement_label: "cache.api.hit.ratio"
      alias: "cache.api.hit.ratio"
      query: '\ASP.NET Apps v4.0.30319(_LM_W3SVC_2_ROOT)\Cache API Hit Ratio'
    • instance_label: "example.com cache api hits"
      instance_name: "LM_W3SVC_2_ROOT"
      measurement_label: "cache.api.hits"
      alias: "cache.api.hits"
      query: '\ASP.NET Apps v4.0.30319(_LM_W3SVC_2_ROOT)\Cache API Hits'

and this will give me the output like this:

2017-08-03T10:50:06+02:00 DBG Publish: {
"@timestamp": "2017-08-03T08:50:06.525Z",
"beat": {
"hostname": "server1",
"name": "server1",
"version": "6.0.0-alpha2"
},
"metricset": {
"module": "windows",
"name": "perfmon"
},
"windows": {
"perfmon": {
"cache": {
"api": {
"entries": xx,
"hit": {
"ratio": xx
},
"hits": xx
}
}
}
}
}

but now there are all the other things? :frowning:

- instance_label: "example.com cache api hits"
  instance_name: "LM_W3SVC_2_ROOT"
  measurement_label: "cache.api.hits"
  alias: "cache.api.hits"

in ES i dont have any way to separate the instances, in above example im only using 1 instance, but later i use 4.

Thanks in advance for any advice!

Cheers,
Dirk

2

@lueneburger, please try the following config. alias is no longer an option. instance_label must be separate by .'s

-instance_label: "cache.api.entries.name"
 instance_name: "LM_W3SVC_2_ROOT"
 measurement_label: "cache.api.entries.total"
 query: ‘\ASP.NET Apps v4.0.30319(_LM_W3SVC_2_ROOT)\Cache API Entries’
-instance_label: "cache.api.hitratio.name"
 instance_name: "LM_W3SVC_2_ROOT"
 measurement_label: "cache.api.hitratio.total"
 query: ‘\ASP.NET Apps v4.0.30319(_LM_W3SVC_2_ROOT)\Cache API Hit Ratio’

With this you should get an output like this

cache: {
    api: {
        entries: {
            name: "LM_W3SVC_2_ROOT",
            total: xxxx
         },
        hitratio: {
            name: "LM_W3SVC_2_ROOT",
            total: xxxx
         }              
    }
}

I hope this makes it a little bit clearer how to separate the counters.

3

Important is that instance_label and measurement_label are named differently.

instance_label: cache.api.entries.name
measurement_label: cache.api.entries.total

Of course you can do something like in your config

instance_label: "example.com cache api entries"
measurement_label: "cache.api.entries"

@andrewkroh, do we have the new config option in 6.0.0-alpha2? @lueneburger, can you try to build from the latest source? I think this is the problem.

4

Hi maddin2016,

great that explains it and this is also working, was testing before and added tags: in the config, that also works.

- module: windows
metricsets: ["perfmon"]
tags: "cnx-api02_ota2012b.carhire-solutions.com" #here :sunny:
enabled: true
period: 10s
perfmon.counters:
- instance_label: "example.com cache api entries"
instance_name: "LM_W3SVC_3_ROOT"
measurement_label: "cache.api.entries"
alias: "cache.api.entries"
query: '\ASP.NET Apps v4.0.30319(_LM_W3SVC_3_ROOT)\Cache API Entries'

then is the outpout is:

2017-08-03T12:33:19+02:00 DBG Publish: {
"@timestamp": "2017-08-03T10:33:19.268Z",
"beat": {
"hostname": "server01",
"name": "server01",
"version": "6.0.0-alpha2"
},
"metricset": {
"module": "windows",
"name": "perfmon"
},
"tags": [
"server01_example.com"
],
"windows": {
"perfmon": {
"cache": {
"api": {
"entries": xx,
"hit": {
"ratio": xx
},
"hits": xx,
"misses": xx,
"trims": xx,
"turnover": {
"rate": xx
}
},
"total": {
"entries": xx,
"hit": {
"ratio": xx
},
"hits": xx,
"misses": xx,
"trims": xx,
"turnover": {
"rate": xx
}
}
}
}
}
}

but will also try your advice, thanks for the help :slight_smile: and have a great day

Cheers,
Dirk

5

@maddin2016 Based on the little labels shown on the commit page the change is only in master. Can you open a PR to add this to the 6.0 branch. That will get the change included in 6.0.0-beta2 (I think beta1 is already frozen).

We have a tool to automate it.

./dev-tools/cherrypick_pr --create_pr 6.0 4655 4a927b49bfd82713d255169682c2907b74effb80

6

@lueneburger, great to hear that it works :slight_smile: Feel free to report any suggestions you have to improve this module. @andrewkroh, thanks for the script. I will open a PR.