Metricbeat - Windows Module - Perfmon Instances truncated with parenthesis

Elastic Stack Beats
,
1

Using 7.9.0 and 7.9.1 (I can't confirm this for earlier versions) it seems there is something off with how it will read instance names to elasticsearch output. If the perfmon instance's name contains parenthesis such as a Network card from Intel, QLogic when looking at the "Per Processor Network Interface Card Activity" object and the "DPCs Queued/sec" counter, which tend to be named like "0, QLogic BCM57840 10 Gigabit Ethernet (NDIS VBD Client) #207" then what will only get parted from metric beat is ""0, QLogic BCM57840 10 Gigabit Ethernet (NDIS VBD Client" and it will truncate right before the closing parenthesis.

Is anyone aware of this and have a workaround? It is important to get the rest of the string as the #207 indicates the actual interface.

Here is the windows.yml module configuration if anyone has interfaces like this to duplicate

    - module: windows
      metricsets:
      - perfmon
      period: 15s
      perfmon.group_measurements_by_instance: true
      perfmon.queries:
       - object: 'Per Processor Network Interface Card Activity'
         instance: ["*"]
         counters:
         - name: 'DPCs Queued/sec'
           field: per_processor_network_interface.dpcs_queued.per_sec
           format: "float"
       - object: 'Processor'
         instance: ["*"]
         counters:
         - name: 'DPCs Queued/sec'
           field: processor.dpcs_queued.per_sec
           format: "float"
         - name: '% DPC Time'
           field: processor.pct_dpc_time
           format: "float"
2

This seems to be the same issue as https://github.com/elastic/beats/issues/9835. Please see the discussion there.

Thanks,

Shaunak

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.