# Windows Module

**URL:** <https://discuss.elastic.co/t/windows-module/81122>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 4, 2017, 11:06am UTC](https://discuss.elastic.co/t/windows-module/81122 "2017-04-04T11:06:43Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [April 4, 2017, 11:06am UTC](https://discuss.elastic.co/t/windows-module/81122/1 "2017-04-04T11:06:43Z")

</div>

Hi Nicolas @ruflin

Am trying to get the perfmon data using Beats. I saw it would be available with the future implementation as a Windows Module ([https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-dev-overview.html](https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-dev-overview.html))

And also I just noticed the code is available in the GITHUB ([https://github.com/elastic/beats/tree/master/metricbeat](https://github.com/elastic/beats/tree/master/metricbeat)) , Could you please help me in finding out the compiled version of the metricbeats with the Windows Perfmon module or please let me know how do I build this code(steps to do). It would really be a great help for me.

Thanks in advance,  
Prakash

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 4, 2017, 11:26am UTC](https://discuss.elastic.co/t/windows-module/81122/2 "2017-04-04T11:26:55Z")

</div>

The snapshot builds can be found here: [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=metricbeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=metricbeat/) These are built from master. Let us know how it works out with the perfmon module.

@maddin2016 FYI

---

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [April 4, 2017, 11:34am UTC](https://discuss.elastic.co/t/windows-module/81122/3 "2017-04-04T11:34:52Z")

</div>

Sure. Thank you @ruflin. I'll keep you posted my findings. 🙂

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 4, 2017, 11:39am UTC](https://discuss.elastic.co/t/windows-module/81122/4 "2017-04-04T11:39:20Z")

</div>

👍

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 4, 2017, 12:29pm UTC](https://discuss.elastic.co/t/windows-module/81122/5 "2017-04-04T12:29:05Z")

</div>

@prakash1243 Please keep in mind that we are actively making changes that affect the perfmon metricset and its configuration format. [https://github.com/elastic/beats/pull/3896](https://github.com/elastic/beats/pull/3896)

And definitely let us know your feedback (good/bad/missing features). Thanks

---

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [April 5, 2017, 8:34am UTC](https://discuss.elastic.co/t/windows-module/81122/6 "2017-04-05T08:34:31Z")

</div>

Sure. 👍  
Thanks 🙂

---

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [April 6, 2017, 6:42am UTC](https://discuss.elastic.co/t/windows-module/81122/7 "2017-04-06T06:42:46Z")

</div>

Hi @andrewkroh -  
I've installed the alpha version on a 32-bit machine, and added around 29 perfmon queries.  
I see the below error when I add the Thread count query:

- alias: "process.thread.count.total"  
query: '\Process(\_Total)\Thread count'

Error Log:  
2017-04-06T07:42:45+02:00 WARN Can not index event (status=400): {"type":"illegal\_argument\_exception","reason":"Limit of total fields [1000] in index [metricbeat-6.0.0-alpha1-2017.04.06] has been exceeded"}

when I comment out the Thread count query, its works as expected.  
I tried commenting out the other queries and enabling the Thread count query back, but still have the same issue.  
Please let me know, if am missing anything. Thanks !

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 6, 2017, 8:23am UTC](https://discuss.elastic.co/t/windows-module/81122/8 "2017-04-06T08:23:35Z")

</div>

This error comes from elasticsearch. You can fix it by changing `settings.index.mapping.total_fields.limit` to `10000` for example. We have it as a default in our template now. [https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings)

I assume it is more a coincidence that this appears now as I assume the processor should only create 1 new field.

---

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [April 6, 2017, 8:32am UTC](https://discuss.elastic.co/t/windows-module/81122/9 "2017-04-06T08:32:24Z")

</div>

> [@ruflin](#):
>
> settings.index.mapping.total\_fields.limit

It worked fine, after increasing the limit. Thanks for your really quick response. 🙂

Thanks !

---

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [May 3, 2017, 4:49am UTC](https://discuss.elastic.co/t/windows-module/81122/10 "2017-05-03T04:49:42Z")

</div>

Hi-  
The snapshot build I consumed, works absolutely fine, I didn't find any issues so far.  
But, when I refresh the fields list of metricbeats to get the new added windows fields, I get this error ([Saved "field" parameter is now invalid. Please select a new field. .... Visualize: "field" is a required parameter](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field-visualize-field-is-a-required-parameter/70034)). Not sure about the status of this issue logged on Github, Just wanted to let you know. Thanks !

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 3, 2017, 3:22pm UTC](https://discuss.elastic.co/t/windows-module/81122/11 "2017-05-03T15:22:15Z")

</div>

You are running against which elasticsearch / kibana version?

---

<div class="post-metadata">

**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Post date:** [May 4, 2017, 4:16am UTC](https://discuss.elastic.co/t/windows-module/81122/12 "2017-05-04T04:16:26Z")

</div>

Both are running against 5.1.1 version. Thanks !

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 9, 2017, 6:25am UTC](https://discuss.elastic.co/t/windows-module/81122/13 "2017-05-09T06:25:11Z")

</div>

@monica I remember seeing that in the past. Do you know if we fixed it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 6:33am UTC](https://discuss.elastic.co/t/windows-module/81122/14 "2017-06-06T06:33:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
