Windows Module

Elastic Stack Beats
1

Hi Nicolas @ruflin

Am trying to get the perfmon data using Beats. I saw it would be available with the future implementation as a Windows Module (https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-dev-overview.html)

And also I just noticed the code is available in the GITHUB (https://github.com/elastic/beats/tree/master/metricbeat) , Could you please help me in finding out the compiled version of the metricbeats with the Windows Perfmon module or please let me know how do I build this code(steps to do). It would really be a great help for me.

Thanks in advance,
Prakash

2

The snapshot builds can be found here: https://beats-nightlies.s3.amazonaws.com/index.html?prefix=metricbeat/ These are built from master. Let us know how it works out with the perfmon module.

@maddin2016 FYI

3

Sure. Thank you @ruflin. I'll keep you posted my findings. :slight_smile:

4

:thumbsup:

5

@prakash1243 Please keep in mind that we are actively making changes that affect the perfmon metricset and its configuration format. https://github.com/elastic/beats/pull/3896

And definitely let us know your feedback (good/bad/missing features). Thanks

6

Sure. :+1:
Thanks :slight_smile:

7

Hi @andrewkroh -
I've installed the alpha version on a 32-bit machine, and added around 29 perfmon queries.
I see the below error when I add the Thread count query:

  • alias: "process.thread.count.total"
    query: '\Process(_Total)\Thread count'

Error Log:
2017-04-06T07:42:45+02:00 WARN Can not index event (status=400): {"type":"illegal_argument_exception","reason":"Limit of total fields [1000] in index [metricbeat-6.0.0-alpha1-2017.04.06] has been exceeded"}

when I comment out the Thread count query, its works as expected.
I tried commenting out the other queries and enabling the Thread count query back, but still have the same issue.
Please let me know, if am missing anything. Thanks !

8

This error comes from elasticsearch. You can fix it by changing settings.index.mapping.total_fields.limit to 10000 for example. We have it as a default in our template now. https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings

I assume it is more a coincidence that this appears now as I assume the processor should only create 1 new field.

9

It worked fine, after increasing the limit. Thanks for your really quick response. :slight_smile:

Thanks !

10

Hi-
The snapshot build I consumed, works absolutely fine, I didn't find any issues so far.
But, when I refresh the fields list of metricbeats to get the new added windows fields, I get this error (Saved "field" parameter is now invalid. Please select a new field. .... Visualize: "field" is a required parameter). Not sure about the status of this issue logged on Github, Just wanted to let you know. Thanks !

11

You are running against which elasticsearch / kibana version?

12

Both are running against 5.1.1 version. Thanks !

13

@monica I remember seeing that in the past. Do you know if we fixed it?

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.