Beats: Metricbeat: Windows Perfmon Instances are truncated.

[JameySteinmann]

I wanted to confirm behavior seen in Metricbeat with Perfmon as seen in the discuss url below. This relates to instances that have parenthesis and # in the interface description for Windows systems.

Get-NetAdapter|fl Name,InterfaceDescription

Name                 : vEthernet (HV Public)
InterfaceDescription : Hyper-V Virtual Ethernet Adapter #2

Name                 : Ethernet 4
InterfaceDescription : Intel(R) I211 Gigabit Network Connection #2

In this case, the below configuration will provide incorrect values for the field windows.perfmon.instance. They will be presented as

• Hyper-V Virtual Ethernet Adapter
• Intel(R

This isn't ideal as both the nic identifying number is lost as well as the full name of the instance if there is a closing ) involved. There appears to be a similar, but closed issue as noted in the discuss url and is #9835. I understand the reason for closing it with processes and preserving start order, this isn't the case for NICs and when troubleshooting resource issues with NICs and RSS queues this information that is needed gets lost from Metricbeat.

Metricbeat

• Version: 7.9.0 7.9.1
• Operating System: Windows Server 2012 - 2019
• Discuss Forum URL: https://discuss.elastic.co/t/metricbeat-windows-module-perfmon-instances-truncated-with-parenthesis/248422
• Steps to Reproduce:

1. Configure metricbeat windows perfmon module

    - module: windows
      metricsets:
      - perfmon
      period: 15s
      perfmon.group_measurements_by_instance: true
      perfmon.queries:
       - object: 'Per Processor Network Interface Card Activity'
         instance: ["*"]
         counters:
         - name: 'DPCs Queued/sec'
           field: per_processor_network_interface.dpcs_queued.per_sec
           format: "float"
       - object: 'Processor'
         instance: ["*"]
         counters:
         - name: 'DPCs Queued/sec'
           field: processor.dpcs_queued.per_sec
           format: "float"
         - name: '% DPC Time'
           field: processor.pct_dpc_time
           format: "float"

1. Run metricbeat and check elasticsearch

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[narph]

hi @JameySteinmann , the strict regular expression put in place to avoid the situation in the previous issue seems to affect cases as these:

Get-Counter -Counter "\Per Processor Network Interface Card Activity(*)\DPCs Queued/sec"

\\...\per processor network interface card activity(0, bluetooth device (personal area network) #3)\dpcs queued/sec :
                          0
\\...\per processor network interface card activity(total, realtek usb gbe family controller #2)\dpcs queued/sec :
                          0
\\...\per processor network interface card activity(3, realtek usb gbe family controller #2)\dpcs queued/sec :
                          0

We will have to take this instance format in account and maybe rethink adding an option to collect the entire instance name, including the counter.

[narph]

@JameySteinmann , we did some work on the existing regular expressions and we are able to return the entire instance name when it comes to cases as above. No necessary configuration required.

[JameySteinmann]

That's great news!