Windows/Perfmon Fatal Error

Elastic Stack Beats
1

Hi-
I added a performance counter in the windows modules and execute module test command, the result was also ok. When I start the service, I see the below message in the logs:

recovered from panic while fetching 'windows/perfmon' for host ''. Recovering, but please report this.	{"panic": "runtime error: slice bounds out of range", "stack": "github.com/elastic/beats/libbeat/logp.Recover\n\t/go/src/github.com/elastic/beats/libbeat/logp/global.go:88\nruntime.call16\n\t/usr/local/go/src/runtime/asm_386.s:559\nruntime.gopanic\n\t/usr/local/go/src/runtime/panic.go:491\nruntime.panicslice\n\t/usr/local/go/src/runtime/panic.go:35\ngithub.com/elastic/beats/metricbeat/module/windows/perfmon.PdhGetFormattedCounterArray\n\t/go/src/github.com/elastic/beats/metricbeat/module/windows/perfmon/pdh_windows.go:134\ngithub.com/elastic/beats/metricbeat/module/windows/perfmon.(*Query).Values\n\t/go/src/github.com/elastic/beats/metricbeat/module/windows/perfmon/pdh_windows.go:269\ngithub.com/elastic/beats/metricbeat/module/windows/perfmon.(*PerfmonReader).Read\n\t/go/src/github.com/elastic/beats/metricbeat/module/windows/perfmon/pdh_windows.go:369\ngithub.com/elastic/beats/metricbeat/module/windows/perfmon.(*MetricSet).Fetch\n\t/go/src/github.com/elastic/beats/metricbeat/module/windows/perfmon/perfmon.go:76\ngithub.com/elastic/beats/metricbeat/mb/module.(*metricSetWrapper).fetch\n\t/go/src/github.com/elastic/beats/metricbeat/mb/module/wrapper.go:213\ngithub.com/elastic/beats/metricbeat/mb/module.(*metricSetWrapper).startPeriodicFetching\n\t/go/src/github.com/elastic/beats/metricbeat/mb/module/wrapper.go:194\ngithub.com/elastic/beats/metricbeat/mb/module.(*metricSetWrapper).run\n\t/go/src/github.com/elastic/beats/metricbeat/mb/module/wrapper.go:171\ngithub.com/elastic/beats/metricbeat/mb/module.(*Wrapper).Start.func1\n\t/go/src/github.com/elastic/beats/metricbeat/mb/module/wrapper.go:112"}

It is tested on WIn 2012 R2 machine

2

Hi,

I'm trying to reproduce the problem. Can you provide the config you're using or the perf counter name that causes this problem?

3

Hi @adrisr-
I just used only one perfmon counter, I see this issue.

- module: windows
  metricsets: [perfmon]
  period: 5s
  perfmon.ignore_non_existent_counters: true
  perfmon.counters:
    - instance_label: processor_privileged_time
      measurement_label: processor.privileged_time
      query: '\Processor(*)\% Privileged Time'
4

Can you share the output of running this on the commandline?

typeperf "\Processor(*)\% Privileged Time"
5

Hi @adrisr-
Here is the output

"10/09/2018 18:06:44.140","7.799535","3.119814","1.559907","1.559907","3.509796"

"10/09/2018 18:06:45.142","4.679719","1.559906","6.239626","7.799532","5.069691"

"10/09/2018 18:06:46.142","1.561469","0.000000","1.561469","3.122937","1.561469"

"10/09/2018 18:06:47.143","3.122939","0.000000","6.245877","1.561469","2.732576"

"10/09/2018 18:06:48.144","1.559906","4.679719","0.000000","1.559906","1.949878"

"10/09/2018 18:06:49.146","4.679588","6.239451","1.559863","1.559863","3.509696"
6

Is that all the output?

In my case the first line is different, it contains a list of the counter names. Do you have that one too? Can you paste it?

7

Sorry @adrisr - The command throws the error as below

Error: No valid counters.

Note:
  In order to use typeperf, you must either be a member of the local
  Performance Log Users group, or the command must be executed from an
  elevated command window.

Please ignore my previous message, I ran that command on a different server. Sorry for the confusion. Thanks !

8

Hi @adrisr - I have added user to the performance log users group, when I run with the typeperf command, I would get the results, but not with the metricbeat. Please let me know if you need any other info. Thanks !

9

So, when the user is added to the perfmon group and you run the above command, what is the full output you get?

I'm interested in the first line starting with PDH-CSV as in here:

C:\> typeperf "\Processor(*)\% Privileged Time"

"(PDH-CSV 4.0)","\\VAGRANT-2012-R2\Processor(0)\% Privileged Time","\\VAGRANT-20
12-R2\Processor(1)\% Privileged Time","\\VAGRANT-2012-R2\Processor(2)\% Privileg
ed Time","\\VAGRANT-2012-R2\Processor(3)\% Privileged Time","\\VAGRANT-2012-R2\P
rocessor(_Total)\% Privileged Time"
"10/09/2018 09:59:30.353","0.000000","0.000000","0.000000","0.000000","0.000000"

"10/09/2018 09:59:31.353","0.000000","0.000000","0.000000","0.000000","0.000000"

"10/09/2018 09:59:32.370","0.000000","0.000000","0.000000","0.000000","0.000000"

"10/09/2018 09:59:33.385","0.000000","0.000000","0.000000","0.000000","0.000000"

"10/09/2018 09:59:34.385","0.000000","0.000000","0.000000","0.000000","0.000000"


The command completed successfully.
10

Hi @adrisr
Here is the output for the query:

"(PDH-CSV 4.0)","\\WIN2012\Processor(0)\% Privileged Time","\\WIN2012\Pr
ocessor(1)\% Privileged Time","\\WIN2012\Processor(2)\% Privileged Time","\\
WIN2012\Processor(3)\% Privileged Time","\\WIN2012\Processor(_Total)\% P
rivileged Time"
"10/10/2018 07:04:05.864","0.000000","0.000000","1.559800","0.000000","0.389945"

"10/10/2018 07:04:06.867","1.558410","1.558410","0.000000","3.116820","1.558410"

"10/10/2018 07:04:07.869","1.559851","3.119701","3.119701","3.119701","2.729744"

"10/10/2018 07:04:08.871","1.558439","3.116877","0.000000","3.116877","1.948043"

"10/10/2018 07:04:09.873","3.119806","6.239613","1.559903","4.679710","3.899758"

"10/10/2018 07:04:10.875","7.799256","9.359107","3.119702","3.119702","5.849447"
11

@adrisr - This happens for most of the queries, for some of the queries metricbeats is running fine.

12

Hi @adrisr -
Could you please help with any work around if you have to overcome this issue with perfmon metricset ? Thanks.

Paul !

13

I've been trying to reproduce the issue without luck. I really would like to understand what is going on.

Can I send you a custom version that includes some additional diagnostics information?

Which exact version are you running? Is it 64 bit right?

14

@adrisr-
Yes, Its 64 bit.
Could you please share that custom version, I'd try with that and let you know my findings. Thanks !

15

Hi,

Here's the link for a special 6.4.2 version
https://drive.google.com/file/d/1ARcPDrOrH8UWzBU6PaooGwqG9mJwNQ7t/view

Run it like this:

  metricbeat.exe run -e -N

It should print messages like this. Please send me the full output:

2018-10-10T09:08:29.566-0700    WARN    perfmon/pdh_windows.go:157      PdhGetFo
rmattedCounterArray out of bounds. sizeof=24 count=5 alloc=150 size=150 base=825
747483136 offset=120
2018-10-10T09:08:29.568-0700    WARN    perfmon/pdh_windows.go:159      Dump: 00
000000  78 aa 62 42 c0 00 00 00  00 00 00 00 00 00 00 00  |x.bB............|
00000010  af 7e 0b 8f 0e ef 06 40  86 aa 62 42 c0 00 00 00  |.~.....@..bB....|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  8a aa 62 42 c0 00 00 00  00 00 00 00 00 00 00 00  |..bB............|
00000040  00 00 00 00 00 00 00 00  8e aa 62 42 c0 00 00 00  |..........bB....|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  92 aa 62 42 c0 00 00 00  00 00 00 00 00 00 00 00  |..bB............|
00000070  2c cc c5 4e 10 ef 26 40  5f 00 54 00 6f 00 74 00  |,..N..&@_.T.o.t.|
00000080  61 00 6c 00 00 00 30 00  00 00 31 00 00 00 32 00  |a.l...0...1...2.|
00000090  00 00 33 00 00 00                                 |..3...|
16

Hi @adrisr-
Here is the output log:

2018-10-10T17:46:25.847+0100    WARN    windows/windows.go:41   Metricbeat is ru
nning without SeDebugPrivilege, a Windows privilege that allows it to collect me
trics from other processes. The user running Metricbeat may not have the appropr
iate privileges or the security policy disallows it.
2018-10-10T17:46:25.847+0100    WARN    [cfgwarn]       perfmon/perfmon.go:59
BETA: The perfmon metricset is beta
2018-10-10T17:46:25.896+0100    INFO    cfgfile/reload.go:141   Config reloader
started
2018-10-10T17:46:25.897+0100    WARN    [cfgwarn]       perfmon/perfmon.go:59
BETA: The perfmon metricset is beta
2018-10-10T17:46:25.898+0100    INFO    cfgfile/reload.go:196   Loading of confi
g files completed.
2018-10-10T17:46:30.899+0100    WARN    perfmon/pdh_windows.go:157      PdhGetFo
rmattedCounterArray out of bounds. sizeof=24 count=5 alloc=150 size=150 base=825
741140128 offset=120
2018-10-10T17:46:30.899+0100    WARN    perfmon/pdh_windows.go:159      Dump: 00
000000  18 e1 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |...B............|
00000010  61 f0 77 05 98 7f f6 3f  26 e1 01 42 c0 00 00 00  |a.w....?&..B....|
00000020  00 00 00 00 00 00 00 00  73 47 15 93 a3 ff 03 40  |........sG.....@|
00000030  2a e1 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |*..B............|
00000040  2c eb 9f 5c 75 ff fd 3f  2e e1 01 42 c0 00 00 00  |,..\u..?...B....|
00000050  00 00 00 00 00 00 00 00  73 47 15 93 a3 ff e3 3f  |........sG.....?|
00000060  32 e1 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |2..B............|
00000070  73 47 15 93 a3 ff e3 3f  5f 00 54 00 6f 00 74 00  |sG.....?_.T.o.t.|
00000080  61 00 6c 00 00 00 30 00  00 00 31 00 00 00 32 00  |a.l...0...1...2.|
00000090  00 00 33 00 00 00                                 |..3...|

2018-10-10T17:46:35.899+0100    WARN    perfmon/pdh_windows.go:157      PdhGetFo
rmattedCounterArray out of bounds. sizeof=24 count=5 alloc=150 size=150 base=825
741140448 offset=120
2018-10-10T17:46:35.900+0100    WARN    perfmon/pdh_windows.go:159      Dump: 00
000000  58 e2 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |X..B............|
00000010  ba 34 f9 a6 a8 7f f6 3f  66 e2 01 42 c0 00 00 00  |.4.....?f..B....|
00000020  00 00 00 00 00 00 00 00  df 2e 88 5b b2 ff f3 3f  |...........[...?|
00000030  6a e2 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |j..B............|
00000040  4d 46 4c 89 8b ff fd 3f  6e e2 01 42 c0 00 00 00  |MFL....?n..B....|
00000050  00 00 00 00 00 00 00 00  96 3a 6a f2 9e ff f8 3f  |.........:j....?|
00000060  72 e2 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |r..B............|
00000070  4d 46 4c 89 8b ff ed 3f  5f 00 54 00 6f 00 74 00  |MFL....?_.T.o.t.|
00000080  61 00 6c 00 00 00 30 00  00 00 31 00 00 00 32 00  |a.l...0...1...2.|
00000090  00 00 33 00 00 00                                 |..3...|

2018-10-10T17:46:40.899+0100    WARN    perfmon/pdh_windows.go:157      PdhGetFo
rmattedCounterArray out of bounds. sizeof=24 count=5 alloc=150 size=150 base=825
744441344 offset=120
2018-10-10T17:46:40.899+0100    WARN    perfmon/pdh_windows.go:159      Dump: 00
000000  78 40 34 42 c0 00 00 00  00 00 00 00 00 00 00 00  |x@4B............|
00000010  02 f6 5b 6b b1 3f 0a 40  86 40 34 42 c0 00 00 00  |..[k.?.@.@4B....|
00000020  00 00 00 00 00 00 00 00  94 40 2a a5 bc 7f 06 40  |.........@*....@|
00000030  8a 40 34 42 c0 00 00 00  00 00 00 00 00 00 00 00  |.@4B............|
00000040  57 f9 e7 9c cb 7f 01 40  8e 40 34 42 c0 00 00 00  |W......@.@4B....|
00000050  00 00 00 00 00 00 00 00  f6 1c 09 21 c4 ff 13 40  |...........!...@|
00000060  92 40 34 42 c0 00 00 00  00 00 00 00 00 00 00 00  |.@4B............|
00000070  33 64 4b 29 b5 ff 08 40  5f 00 54 00 6f 00 74 00  |3dK)...@_.T.o.t.|
00000080  61 00 6c 00 00 00 30 00  00 00 31 00 00 00 32 00  |a.l...0...1...2.|
00000090  00 00 33 00 00 00                                 |..3...|

2018-10-10T17:46:45.898+0100    WARN    perfmon/pdh_windows.go:157      PdhGetFo
rmattedCounterArray out of bounds. sizeof=24 count=5 alloc=150 size=150 base=825
741140768 offset=120
2018-10-10T17:46:45.898+0100    WARN    perfmon/pdh_windows.go:159      Dump: 00
000000  98 e3 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |...B............|
00000010  bc 99 5c 5e ee a0 19 40  a6 e3 01 42 c0 00 00 00  |..\^...@...B....|
00000020  00 00 00 00 00 00 00 00  bc 9e 69 cf ff 80 1b 40  |..........i....@|
00000030  aa e3 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |...B............|
00000040  11 46 b6 2e f4 40 1a 40  ae e3 01 42 c0 00 00 00  |.F...@.@...B....|
00000050  00 00 00 00 00 00 00 00  b8 8a 35 0b ba 00 14 40  |..........5....@|
00000060  b2 e3 01 42 c0 00 00 00  00 00 00 00 00 00 00 00  |...B............|
00000070  68 f7 1c 70 0b c1 1c 40  5f 00 54 00 6f 00 74 00  |h..p...@_.T.o.t.|
00000080  61 00 6c 00 00 00 30 00  00 00 31 00 00 00 32 00  |a.l...0...1...2.|
00000090  00 00 33 00 00 00                                 |..3...|

2018-10-10T17:46:46.385+0100    INFO    cfgfile/reload.go:199   Dynamic config r
eloader stopped
2018-10-10T17:46:46.386+0100    INFO    [reload]        cfgfile/list.go:126
Stopping 1 runners ...
2018-10-10T17:46:46.414+0100    INFO    [monitoring]    log/log.go:149  Total no
n-zero metrics  {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":62,
"time":{"ms":78}},"total":{"ticks":93,"time":{"ms":109},"value":0},"user":{"tick
s":31,"time":{"ms":31}}},"info":{"ephemeral_id":"d608b999-11a5-48df-80da-7fdc10a
e4bfb","uptime":{"ms":21224}},"memstats":{"gc_next":5191264,"memory_alloc":33247
28,"memory_total":8593216,"rss":29827072}},"libbeat":{"config":{"module":{"runni
ng":0},"reloads":1},"pipeline":{"clients":1,"events":{"active":0,"filtered":4,"t
otal":4}}},"metricbeat":{"windows":{"perfmon":{"events":4,"failures":4}}},"syste
m":{"cpu":{"cores":4}}}}}
2018-10-10T17:46:46.415+0100    INFO    [monitoring]    log/log.go:150  Uptime:
21.2254251s
2018-10-10T17:46:46.415+0100    INFO    [monitoring]    log/log.go:127  Stopping
 metrics logging.
2018-10-10T17:46:46.416+0100    INFO    instance/beat.go:373    metricbeat stopp
ed.

I ran the metricbeats with the test metricbeat.exe, beats didn't get terminated, but this is shown in the dashboard: **failed on query=\Processor(*)% Privileged Time: panic

17

I made a mistake, can you try with this other version?

https://drive.google.com/file/d/1WHi1asNo8b-BCJdgCrAHXlSb-hxIMCFl/view?usp=sharing

Thanks

18

@adrisr - Here is the log:

2018-10-10T18:39:32.708+0100    INFO    instance/beat.go:544    Home path: [C:\U
sers\admin\Desktop\metricbeat-6.4.2-testing-2] Config path: [C:\Use
rs\srvadmin\Desktop\metricbeat-6.4.2-testing-2] Data path: [C:\Users\admin\Desktop\metricbeat-6.4.2-testing-2\data] Logs path: [C:\Users\
admin\Desktop\metricbeat-6.4.2-testing-2\logs]
2018-10-10T18:39:32.709+0100    INFO    instance/beat.go:551    Beat UUID: 0722a
215-4a98-4cda-bf54-45e5afe825ee
2018-10-10T18:39:32.709+0100    INFO    [beat]  instance/beat.go:768    Beat inf
o       {"system_info": {"beat": {"path": {"config": "C:\\Users\\ad
min\\Desktop\\metricbeat-6.4.2-testing-2", "data": "C:\\Users\\admi
n\\Desktop\\metricbeat-6.4.2-testing-2\\data", "home": "C:\\Users\\admin\\Desktop\\metricbeat-6.4.2-testing-2", "logs": "C:\\Users\\admin\\Desktop\\metricbeat-6.4.2-testing-2\\logs"}, "type": "metricbeat", "uuid":
"0722a215-4a98-4cda-bf54-45e5afe825ee"}}}
2018-10-10T18:39:32.710+0100    INFO    [beat]  instance/beat.go:777    Build in
fo      {"system_info": {"build": {"commit": "e193f6d68b25b7ddbe3a3ed8d60bc07fea
1ef800", "libbeat": "6.4.2", "time": "2018-10-10T17:09:30.000Z", "version": "6.4
.2"}}}
2018-10-10T18:39:32.710+0100    INFO    [beat]  instance/beat.go:780    Go runti
me info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"ver
sion":"go1.10.3"}}}
2018-10-10T18:39:32.716+0100    INFO    [beat]  instance/beat.go:784    Host inf
o       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2018-10-1
0T12:34:08.46+01:00","hostname":"Site_1","ips":["fe80::cbc:3664:9a41:e9cc/6
4","172.20.209.104/24","fe80::14a2:65b0:1deb:ff41/64","10.20.212.107/17","fe80::
ccfd:3049:5f31:365c/64","169.254.54.92/16","::1/128","127.0.0.1/8"],"kernel_vers
ion":"6.3.9600.19101 (winblue_ltsb_escrow.180718-1800)","mac_addresses":["14:02:
ec:6a:f0:a8","d0:bf:9c:3a:58:95","d0:bf:9c:3a:58:94"],"os":{"family":"windows","
platform":"windows","name":"Windows Server 2012 R2 Standard","version":"6.3","ma
jor":3,"minor":0,"patch":0,"build":"9600.19102"},"timezone":"CET","timezone_offs
et_sec":3600,"id":"1d460637-be2f-4fc3-b317-62199110f3fb"}}}
2018-10-10T18:39:32.717+0100    INFO    instance/beat.go:273    Setup Beat: metr
icbeat; Version: 6.4.2
2018-10-10T18:39:32.717+0100    INFO    pipeline/module.go:54   Dry run mode. Al
l output types except the file based one are disabled.
2018-10-10T18:39:32.718+0100    INFO    pipeline/module.go:98   Beat name: admin
2018-10-10T18:39:32.718+0100    INFO    instance/beat.go:367    metricbeat start
 running.
2018-10-10T18:39:32.718+0100    INFO    [monitoring]    log/log.go:114  Starting
 metrics logging every 30s
2018-10-10T18:39:32.720+0100    INFO    helper/privileges_windows.go:79 Metricbe
at process and system info: {"OSVersion":{"Major":6,"Minor":2,"Build":9200},"Arc
h":"amd64","NumCPU":4,"User":{"SID":"S-1-5-21-1364198309-2651714409-1072447096-1
001","Account":"admin","Domain":"SITES","Type":1},"ProcessPri
vs":{"SeChangeNotifyPrivilege":{"enabled_by_default":true,"enabled":true},"SeInc
reaseWorkingSetPrivilege":{"enabled":false},"SeShutdownPrivilege":{"enabled":fal
se},"SeTimeZonePrivilege":{"enabled":false},"SeUndockPrivilege":{"enabled":false
}}}
2018-10-10T18:39:32.721+0100    WARN    windows/windows.go:41   Metricbeat is ru
nning without SeDebugPrivilege, a Windows privilege that allows it to collect me
trics from other processes. The user running Metricbeat may not have the appropr
iate privileges or the security policy disallows it.
2018-10-10T18:39:32.721+0100    WARN    [cfgwarn]       perfmon/perfmon.go:59
BETA: The perfmon metricset is beta
2018-10-10T18:39:32.776+0100    INFO    cfgfile/reload.go:141   Config reloader
started
2018-10-10T18:39:32.778+0100    WARN    [cfgwarn]       perfmon/perfmon.go:59
BETA: The perfmon metricset is beta
2018-10-10T18:39:32.782+0100    INFO    cfgfile/reload.go:196   Loading of confi
g files completed.
2018-10-10T18:40:02.743+0100    INFO    [monitoring]    log/log.go:141  Non-zero
 metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"syst
em":{"ticks":46,"time":{"ms":46}},"total":{"ticks":186,"time":{"ms":186},"value"
:186},"user":{"ticks":140,"time":{"ms":140}}},"info":{"ephemeral_id":"aa597da9-8
27c-4f03-87e2-23e71e148fea","uptime":{"ms":30654}},"memstats":{"gc_next":8390800
,"memory_alloc":6651032,"memory_total":33205304,"rss":33103872}},"libbeat":{"con
fig":{"module":{"running":0},"reloads":1},"pipeline":{"clients":2,"events":{"act
ive":0,"filtered":4283,"total":4283}}},"metricbeat":{"windows":{"perfmon":{"even
ts":4283,"success":4283}}},"system":{"cpu":{"cores":4}}}}}
2018-10-10T18:40:32.719+0100    INFO    [monitoring]    log/log.go:141  Non-zero
 metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"syst
em":{"ticks":46},"total":{"ticks":311,"time":{"ms":125},"value":311},"user":{"ti
cks":265,"time":{"ms":125}}},"info":{"ephemeral_id":"aa597da9-827c-4f03-87e2-23e
71e148fea","uptime":{"ms":60654}},"memstats":{"gc_next":8464736,"memory_alloc":6
439104,"memory_total":55271600,"rss":2347008}},"libbeat":{"config":{"module":{"r
unning":0}},"pipeline":{"clients":2,"events":{"active":0,"filtered":3865,"total"
:3865}}},"metricbeat":{"windows":{"perfmon":{"events":3865,"failures":12,"succes
s":3853}}}}}}
2018-10-10T18:41:02.719+0100    INFO    [monitoring]    log/log.go:141  Non-zero
 metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"syst
em":{"ticks":46},"total":{"ticks":389,"time":{"ms":78},"value":389},"user":{"tic
ks":343,"time":{"ms":78}}},"info":{"ephemeral_id":"aa597da9-827c-4f03-87e2-23e71
e148fea","uptime":{"ms":90653}},"memstats":{"gc_next":9327744,"memory_alloc":556
6368,"memory_total":77035864,"rss":573440}},"libbeat":{"config":{"module":{"runn
ing":0}},"pipeline":{"clients":2,"events":{"active":0,"filtered":3807,"total":38
07}}},"metricbeat":{"windows":{"perfmon":{"events":3807,"failures":12,"success":

And I executed the metricbeats and below is the log:

2018-10-10T18:47:20.848+0100	WARN	elasticsearch/client.go:520	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbee7aca980de4658, ext:710889001, loc:(*time.Location)(0x2952700)}, Meta:common.MapStr(nil), Fields:common.MapStr{"metricset":common.MapStr{"name":"perfmon", "module":"windows", "rtt":6016}, "windows":common.MapStr{"perfmon":common.MapStr{"memory_committed_bytes":"total", "memory":common.MapStr{"committed":common.MapStr{"bytes":2.312626176e+09}}}}, "beat":common.MapStr{"name":"Site", "hostname":"Site_1", "version":"6.4.2"}, "host":common.MapStr{"name":"Site"}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [windows.perfmon.memory.committed.bytes] tried to parse field [bytes] as object, but found a concrete value"}
19

hi @adrisr - do you see anything wrong with the logs I shared above?

20

Did you run it like this?

 metricbeat.exe run -e -N

It seems to me like -N is missing because it's trying to publish documents.