Using 7.9.0 and 7.9.1 (I can't confirm this for earlier versions) it seems there is something off with how it will read instance names to elasticsearch output. If the perfmon instance's name contains parenthesis such as a Network card from Intel, QLogic when looking at the "Per Processor Network Interface Card Activity" object and the "DPCs Queued/sec" counter, which tend to be named like "0, QLogic BCM57840 10 Gigabit Ethernet (NDIS VBD Client) #207" then what will only get parted from metric beat is ""0, QLogic BCM57840 10 Gigabit Ethernet (NDIS VBD Client" and it will truncate right before the closing parenthesis.
Is anyone aware of this and have a workaround? It is important to get the rest of the string as the #207 indicates the actual interface.
Here is the windows.yml module configuration if anyone has interfaces like this to duplicate
- module: windows metricsets: - perfmon period: 15s perfmon.group_measurements_by_instance: true perfmon.queries: - object: 'Per Processor Network Interface Card Activity' instance: ["*"] counters: - name: 'DPCs Queued/sec' field: per_processor_network_interface.dpcs_queued.per_sec format: "float" - object: 'Processor' instance: ["*"] counters: - name: 'DPCs Queued/sec' field: processor.dpcs_queued.per_sec format: "float" - name: '% DPC Time' field: processor.pct_dpc_time format: "float"