Windows Module

(Mike ) #1

Hi Nicolas @ruflin

Am trying to get the perfmon data using Beats. I saw it would be available with the future implementation as a Windows Module (

And also I just noticed the code is available in the GITHUB ( , Could you please help me in finding out the compiled version of the metricbeats with the Windows Perfmon module or please let me know how do I build this code(steps to do). It would really be a great help for me.

Thanks in advance,

(ruflin) #2

The snapshot builds can be found here: These are built from master. Let us know how it works out with the perfmon module.

@maddin2016 FYI

(Mike ) #3

Sure. Thank you @ruflin. I'll keep you posted my findings. :slight_smile:

(Maddin2016) #4


(Andrew Kroh) #5

@prakash1243 Please keep in mind that we are actively making changes that affect the perfmon metricset and its configuration format.

And definitely let us know your feedback (good/bad/missing features). Thanks

(Mike ) #6

Sure. :+1:
Thanks :slight_smile:

(Mike ) #7

Hi @andrewkroh -
I've installed the alpha version on a 32-bit machine, and added around 29 perfmon queries.
I see the below error when I add the Thread count query:

  • alias: ""
    query: '\Process(_Total)\Thread count'

Error Log:
2017-04-06T07:42:45+02:00 WARN Can not index event (status=400): {"type":"illegal_argument_exception","reason":"Limit of total fields [1000] in index [metricbeat-6.0.0-alpha1-2017.04.06] has been exceeded"}

when I comment out the Thread count query, its works as expected.
I tried commenting out the other queries and enabling the Thread count query back, but still have the same issue.
Please let me know, if am missing anything. Thanks !

(ruflin) #8

This error comes from elasticsearch. You can fix it by changing settings.index.mapping.total_fields.limit to 10000 for example. We have it as a default in our template now.

I assume it is more a coincidence that this appears now as I assume the processor should only create 1 new field.

(Mike ) #9

It worked fine, after increasing the limit. Thanks for your really quick response. :slight_smile:

Thanks !

(Mike ) #10

The snapshot build I consumed, works absolutely fine, I didn't find any issues so far.
But, when I refresh the fields list of metricbeats to get the new added windows fields, I get this error (Saved "field" parameter is now invalid. Please select a new field. .... Visualize: "field" is a required parameter). Not sure about the status of this issue logged on Github, Just wanted to let you know. Thanks !

(ruflin) #11

You are running against which elasticsearch / kibana version?

(Mike ) #12

Both are running against 5.1.1 version. Thanks !

(ruflin) #13

@monica I remember seeing that in the past. Do you know if we fixed it?

(system) #14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.