Using 7.9.0 and 7.9.1 (I can't confirm this for earlier versions) it seems there is something off with how it will read instance names to elasticsearch output. If the perfmon instance's name contains parenthesis such as a Network card from Intel, QLogic when looking at the "Per Processor Network Interface Card Activity" object and the "DPCs Queued/sec" counter, which tend to be named like "0, QLogic BCM57840 10 Gigabit Ethernet (NDIS VBD Client) #207" then what will only get parted from metric beat is ""0, QLogic BCM57840 10 Gigabit Ethernet (NDIS VBD Client" and it will truncate right before the closing parenthesis.
Is anyone aware of this and have a workaround? It is important to get the rest of the string as the #207 indicates the actual interface.
Here is the windows.yml module configuration if anyone has interfaces like this to duplicate
- module: windows
metricsets:
- perfmon
period: 15s
perfmon.group_measurements_by_instance: true
perfmon.queries:
- object: 'Per Processor Network Interface Card Activity'
instance: ["*"]
counters:
- name: 'DPCs Queued/sec'
field: per_processor_network_interface.dpcs_queued.per_sec
format: "float"
- object: 'Processor'
instance: ["*"]
counters:
- name: 'DPCs Queued/sec'
field: processor.dpcs_queued.per_sec
format: "float"
- name: '% DPC Time'
field: processor.pct_dpc_time
format: "float"