Windows Module


(Mike ) #1

Hi Nicolas @ruflin

Am trying to get the perfmon data using Beats. I saw it would be available with the future implementation as a Windows Module (https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-dev-overview.html)

And also I just noticed the code is available in the GITHUB (https://github.com/elastic/beats/tree/master/metricbeat) , Could you please help me in finding out the compiled version of the metricbeats with the Windows Perfmon module or please let me know how do I build this code(steps to do). It would really be a great help for me.

Thanks in advance,
Prakash


(ruflin) #2

The snapshot builds can be found here: https://beats-nightlies.s3.amazonaws.com/index.html?prefix=metricbeat/ These are built from master. Let us know how it works out with the perfmon module.

@maddin2016 FYI


(Mike ) #3

Sure. Thank you @ruflin. I'll keep you posted my findings. :slight_smile:


(Maddin2016) #4

:thumbsup:


(Andrew Kroh) #5

@prakash1243 Please keep in mind that we are actively making changes that affect the perfmon metricset and its configuration format. https://github.com/elastic/beats/pull/3896

And definitely let us know your feedback (good/bad/missing features). Thanks


(Mike ) #6

Sure. :+1:
Thanks :slight_smile:


(Mike ) #7

Hi @andrewkroh -
I've installed the alpha version on a 32-bit machine, and added around 29 perfmon queries.
I see the below error when I add the Thread count query:

  • alias: "process.thread.count.total"
    query: '\Process(_Total)\Thread count'

Error Log:
2017-04-06T07:42:45+02:00 WARN Can not index event (status=400): {"type":"illegal_argument_exception","reason":"Limit of total fields [1000] in index [metricbeat-6.0.0-alpha1-2017.04.06] has been exceeded"}

when I comment out the Thread count query, its works as expected.
I tried commenting out the other queries and enabling the Thread count query back, but still have the same issue.
Please let me know, if am missing anything. Thanks !


(ruflin) #8

This error comes from elasticsearch. You can fix it by changing settings.index.mapping.total_fields.limit to 10000 for example. We have it as a default in our template now. https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings

I assume it is more a coincidence that this appears now as I assume the processor should only create 1 new field.


(Mike ) #9

It worked fine, after increasing the limit. Thanks for your really quick response. :slight_smile:

Thanks !


(Mike ) #10

Hi-
The snapshot build I consumed, works absolutely fine, I didn't find any issues so far.
But, when I refresh the fields list of metricbeats to get the new added windows fields, I get this error (Saved "field" parameter is now invalid. Please select a new field. .... Visualize: "field" is a required parameter). Not sure about the status of this issue logged on Github, Just wanted to let you know. Thanks !


(ruflin) #11

You are running against which elasticsearch / kibana version?


(Mike ) #12

Both are running against 5.1.1 version. Thanks !


(ruflin) #13

@monica I remember seeing that in the past. Do you know if we fixed it?


(system) #14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.