I haven't tried it yet, but do plan to soon.
Hi @andrewkroh, because kibana is not supporting arrays of objects, should I create a new object per counter per event? So for example if I have 3 counters I would create 3 single events and push them to elastic.
You can combine multiple counters/gauges into a single event where it makes sense. For example you could send all processor related metrics in an event with keys like:
windows.perfmon.processor.total_time
windows.perfmon.processor.idle_time
and send a separate event for a memory metrics like:
windows.perfmon.memory.available_bytes
.
Sounds good. Then i think its a good idea to separate them by groups to make it easier to filter them. For example
counters:
-processor
- alias: "total_time"
query: "\\Prozessorinformationen(*)\\Prozessorzeit (%)"
...
-memory
- alias: "available_bytes"
query: "\\Prozessorinformationen(*)\\Prozessorzeit (%)"
....