# Wmi: cannot load field "CommandLine" into a "string": unsupported type (\<nil\>)

**URL:** <https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [March 14, 2018, 3:23pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931 "2018-03-14T15:23:20Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![phil.zac](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@phil.zac](https://discuss.elastic.co/u/phil.zac)\
**Post date:** [March 14, 2018, 3:23pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/1 "2018-03-14T15:23:20Z")

</div>

Hi,

I am using

elasticsearch-5.6.1  
kibana-5.6.1  
logstash-5.6.1  
metricbeat-5.6.1  
packetbeat-5.6.1  
x-pack-5.6.1

for Windows Server 2012 R2

I am working on Metric beats and find this error.

```
2018/03/14 15:16:48.733387 helper.go:347: ERR Error getting process details. pid=2472: error getting process arguments for pid=2472: ProcArgs failed for pid=2472: could not get Win32_Process
 WHERE ProcessId = 2472: wmi: cannot load field "CommandLine" into a "string": unsupported type (<nil>)
2018/03/14 15:16:48.845387 helper.go:347: ERR Error getting process details. pid=7052: error getting process arguments for pid=7052: ProcArgs failed for pid=7052: could not get Win32_Process
 WHERE ProcessId = 7052: wmi: cannot load field "CommandLine" into a "string": unsupported type (<nil>)
2018/03/14 15:16:58.755113 helper.go:347: ERR Error getting process details. pid=2472: error getting process arguments for pid=2472: ProcArgs failed for pid=2472: could not get Win32_Process
 WHERE ProcessId = 2472: wmi: cannot load field "CommandLine" into a "string": unsupported type (<nil>)
2018/03/14 15:17:01.683231 helper.go:347: ERR Error getting process details. pid=7052: error getting process arguments for pid=7052: ProcArgs failed for pid=7052: could not get Win32_Process
 WHERE ProcessId = 7052: wmi: cannot load field "CommandLine" into a "string": unsupported type (<nil>)
2018/03/14 15:17:08.736718 helper.go:347: ERR Error getting process details. pid=2472: error getting process arguments for pid=2472: ProcArgs failed for pid=2472: could not get Win32_Process
 WHERE ProcessId = 2472: wmi: cannot load field "CommandLine" into a "string": unsupported type (<nil>)
2018/03/14 15:17:08.847724 helper.go:347: ERR Error getting process details. pid=7052: error getting process arguments for pid=7052: ProcArgs failed for pid=7052: could not get Win32_Process
 WHERE ProcessId = 7052: wmi: cannot load field "CommandLine" into a "string": unsupported type (<nil>)

```

I looked for system.yml as stated in [Cannot load field "CommandLine" into a "string": unsupported type](https://discuss.elastic.co/t/cannot-load-field-commandline-into-a-string-unsupported-type/115897)

But could not find system.yml. only place where "metricset" is found is in metricbeat.yml

```
metricbeat.exe -e -d "module"

2018/03/14 15:21:44.587005 wrapper.go:128: DBG Starting Wrapper[name=system, len(metricSetWrappers)=6]
2018/03/14 15:21:44.587005 wrapper.go:149: DBG Stopped Wrapper[name=system, len(metricSetWrappers)=6]
2018/03/14 15:21:44.587005 wrapper.go:186: DBG Starting metricSetWrapper[module=system, name=memory, host=]
2018/03/14 15:21:44.587005 wrapper.go:186: DBG Starting metricSetWrapper[module=system, name=network, host=]
2018/03/14 15:21:44.587005 wrapper.go:186: DBG Starting metricSetWrapper[module=system, name=fsstat, host=]
2018/03/14 15:21:44.587005 wrapper.go:186: DBG Starting metricSetWrapper[module=system, name=cpu, host=]
2018/03/14 15:21:44.587005 wrapper.go:186: DBG Starting metricSetWrapper[module=system, name=process, host=]
2018/03/14 15:21:44.587005 wrapper.go:186: DBG Starting metricSetWrapper[module=system, name=filesystem, host=]

```

Let me know how to solve this issues.

Thanks.

Phil

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 14, 2018, 5:50pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/2 "2018-03-14T17:50:45Z")

</div>

Could you check what those PIDs are with another tool like the Task Manager?

I'm wondering if they are protected processes or something special.

---

<div class="post-metadata">

**Author:** ![phil.zac](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@phil.zac](https://discuss.elastic.co/u/phil.zac)\
**Post date:** [March 14, 2018, 6:02pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/3 "2018-03-14T18:02:44Z")

</div>

Hi

Yes I see them as something "xagt.exe".

Thanks.

Phil

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 14, 2018, 6:17pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/4 "2018-03-14T18:17:20Z")

</div>

Interesting. Can you run a Powershell command and share what it returns? Replace the process ID with one that's giving you the error in Metricbeat.

```auto
PS C:\Users\me > Get-WmiObject -Query "select * from win32_process where ProcessId=2472" | Format-List

```

---

<div class="post-metadata">

**Author:** ![phil.zac](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@phil.zac](https://discuss.elastic.co/u/phil.zac)\
**Post date:** [March 14, 2018, 6:29pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/5 "2018-03-14T18:29:46Z")

</div>

2472

```
__GENUS : 2
__CLASS : Win32_Process
__SUPERCLASS : CIM_Process
__DYNASTY : ****************
__RELPATH : Win32_Process.Handle="2472"
__PROPERTY_COUNT : 45
__DERIVATION : { ********************* }
__SERVER : *********
__NAMESPACE : ***********
__PATH : ************ ="2472"
Caption : xagt.exe
CommandLine :
CreationClassName : Win32_Process
CreationDate : *********.118869-240
CSCreationClassName : Win32_ComputerSystem
CSName : ***********
Description : xagt.exe
ExecutablePath :
ExecutionState :
Handle : 2472
HandleCount : 352
InstallDate :
KernelModeTime : 215000000
MaximumWorkingSetSize : 1380
MinimumWorkingSetSize : 200
Name : xagt.exe
OSCreationClassName : Win32_OperatingSystem
OSName : Microsoft Windows Server 2012 R2 Standard| ************
OtherOperationCount : 304541
OtherTransferCount : 2292436
PageFaults : 537908
PageFileUsage : 11100
ParentProcessId : 576
PeakPageFileUsage : 48064
PeakVirtualSize : **********
PeakWorkingSetSize : 51664
Priority : 8
PrivatePageCount : 11366400
ProcessId : 2472
QuotaNonPagedPoolUsage : 20
QuotaPagedPoolUsage : 177
QuotaPeakNonPagedPoolUsage : 30
QuotaPeakPagedPoolUsage : 187
ReadOperationCount : 579821
ReadTransferCount : 908215321
SessionId : 0
Status :
TerminationDate :
ThreadCount : 11
UserModeTime : 223750000
VirtualSize : *****************
WindowsVersion : 6.3.9600
WorkingSetSize : 15237120
WriteOperationCount : 1169648
WriteTransferCount : 782955054
PSComputerName : **********
ProcessName : xagt.exe
Handles : 352
VM : **************
WS : ************
Path :slight_smile:

```

7052

Similar to above

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 14, 2018, 6:43pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/6 "2018-03-14T18:43:23Z")

</div>

Ok, this sounds like an error that Metricbeat should handle. When it gets a null string back from WMI it should either send an empty `system.process.cmdline` field or omit it.

Can you please open a new issue in [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new) for this. Drop a link to this discussion in the ticket.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 14, 2018, 6:45pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/7 "2018-03-14T18:45:35Z")

</div>

For now you can continue using Metricbeat and ignore those errors. You will continue to get data on other processes. It should just be for `xagt.exe` that you don't get metrics any on.

---

<div class="post-metadata">

**Author:** ![phil.zac](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@phil.zac](https://discuss.elastic.co/u/phil.zac)\
**Post date:** [March 14, 2018, 6:59pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/8 "2018-03-14T18:59:58Z")

</div>

Thanks.

Seems that I need to create NEW Github account to open an issue?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 7:09pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931/9 "2018-04-11T19:09:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.