Skip to content

Commit

Permalink
Merge branch 'main' into bump-libs
Browse files Browse the repository at this point in the history
  • Loading branch information
mauri870 authored Mar 6, 2025
2 parents 27275e9 + 180bd96 commit cb01a9e
Show file tree
Hide file tree
Showing 6 changed files with 110 additions and 17 deletions.
18 changes: 10 additions & 8 deletions .buildkite/packaging.pipeline.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ env:
GCP_DEFAULT_MACHINE_TYPE: "c2d-standard-8"
IMAGE_UBUNTU_X86_64: "family/platform-ingest-beats-ubuntu-2204"

PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
PLATFORMS_ARM: "linux/arm64"
PLATFORMS: "+all linux/amd64 windows/amd64 darwin/amd64 darwin/arm64"
PLATFORMS_ARM: "+all linux/arm64"

steps:
# we use concurrency gates (https://buildkite.com/blog/concurrency-gates)
Expand Down Expand Up @@ -121,10 +121,9 @@ steps:
- x-pack/packetbeat
- x-pack/winlogbeat

- label: "SNAPSHOT: {{matrix}} docker Linux/arm64"
- label: "SNAPSHOT: {{matrix}} Linux/arm64"
env:
PLATFORMS: "${PLATFORMS_ARM}"
PACKAGES: "docker"
SNAPSHOT: true
# packaging with `DEV=true` may cause linker issues while crosscompiling https://github.com/elastic/beats/issues/41270
DEV: false
Expand All @@ -151,9 +150,11 @@ steps:
- x-pack/heartbeat
- x-pack/metricbeat
- x-pack/packetbeat
- x-pack/osquerybeat
- x-pack/agentbeat

## Agentbeat needs more CPUs because it builds many other beats
- label: "SNAPSHOT: x-pack/agentbeat"
- label: "SNAPSHOT: x-pack/agentbeat all artifacts apart from linux/arm64"
env:
PLATFORMS: "${PLATFORMS}"
SNAPSHOT: true
Expand Down Expand Up @@ -211,10 +212,9 @@ steps:
- x-pack/packetbeat
- x-pack/winlogbeat

- label: "STAGING: {{matrix}} docker Linux/arm64"
- label: "STAGING: {{matrix}} Linux/arm64"
env:
PLATFORMS: "${PLATFORMS_ARM}"
PACKAGES: "docker"
SNAPSHOT: false
DEV: false
command: |
Expand Down Expand Up @@ -242,9 +242,11 @@ steps:
- x-pack/heartbeat
- x-pack/metricbeat
- x-pack/packetbeat
- x-pack/osquerybeat
- x-pack/agentbeat

## Agentbeat needs more CPUs because it builds many other beats
- label: "STAGING: x-pack/agentbeat"
- label: "STAGING: x-pack/agentbeat all artifacts apart from linux/arm64"
env:
PLATFORMS: "${PLATFORMS}"
SNAPSHOT: false
Expand Down
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -474,6 +474,7 @@ otherwise no tag is added. {issue}42208[42208] {pull}42403[42403]
- Add new metricset wmi for the windows module. {pull}42017[42017]
- Update beat module with apm-server tail sampling monitoring metrics fields {pull}42569[42569]
- Log every 401 response from Kubernetes API Server {pull}42714[42714]
- Add a new `match_by_parent_instance` option to `perfmon` module. {pull}43002[43002]

*Metricbeat*
- Add benchmark module {pull}41801[41801]
Expand Down
7 changes: 7 additions & 0 deletions metricbeat/module/windows/perfmon/_meta/docs.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,13 @@ The default behaviour is for all measurements to be sent as separate events.

*`refresh_wildcard_counters`*:: A boolean option to refresh the counter list at each fetch. By default, the counter list will be retrieved at the starting time, to refresh the list at each fetch, users will have to enable this setting.

*`match_by_parent_instance`*:: A boolean option that causes all instances
of the same parent to have the same instance value. In the above example,
this will cause metrics for `svchost`, `svchost#1`, etc. to have an `instance`
value of `svchost`. If set to `false` they will keep the original values
(`svchost`, `svchost#1`, etc.).
It defaults to `true`.


[float]
==== Query Configuration
Expand Down
5 changes: 5 additions & 0 deletions metricbeat/module/windows/perfmon/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ type Config struct {
RefreshWildcardCounters bool `config:"perfmon.refresh_wildcard_counters"`
Queries []Query `config:"perfmon.queries"`
GroupAllCountersTo string `config:"perfmon.group_all_counter"`
MatchByParentInstance *bool `config:"perfmon.match_by_parent_instance"`
}

// QueryConfig for perfmon queries. This will be used as the new configuration format
Expand Down Expand Up @@ -77,6 +78,10 @@ func (conf *Config) Validate() error {
return nil
}

func (conf *Config) ShouldMatchByParentInstance() bool {
return conf.MatchByParentInstance == nil || *conf.MatchByParentInstance
}

func isValidFormat(format string) bool {
for _, form := range allowedFormats {
if form == format {
Expand Down
20 changes: 11 additions & 9 deletions metricbeat/module/windows/perfmon/data.go
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,14 @@ func (re *Reader) groupToEvents(counters map[string][]pdh.CounterValue) []mb.Eve
eventMap[eventKey].Error = fmt.Errorf("failed on query=%v: %w", counterPath, val.Err.Error)
}
if val.Instance != "" {
// will ignore instance index
if ok, match := matchesParentProcess(val.Instance); ok {
eventMap[eventKey].MetricSetFields.Put(counter.InstanceField, match)
} else {
eventMap[eventKey].MetricSetFields.Put(counter.InstanceField, val.Instance)
instanceName := val.Instance
if re.config.ShouldMatchByParentInstance() {
if ok, match := matchesParentProcess(val.Instance); ok {
// will ignore instance index
instanceName = match
}
}
eventMap[eventKey].MetricSetFields.Put(counter.InstanceField, instanceName)
}
}

Expand Down Expand Up @@ -126,13 +128,13 @@ func (re *Reader) groupToSingleEvent(counters map[string][]pdh.CounterValue) mb.
continue
}
var counterVal float64
switch val.Measurement.(type) {
switch m := val.Measurement.(type) {
case int64:
counterVal = float64(val.Measurement.(int64))
counterVal = float64(m)
case int:
counterVal = float64(val.Measurement.(int))
counterVal = float64(m)
default:
counterVal = val.Measurement.(float64)
counterVal, _ = val.Measurement.(float64)
}
if _, ok := measurements[readerCounter.QueryField]; !ok {
measurements[readerCounter.QueryField] = counterVal
Expand Down
76 changes: 76 additions & 0 deletions metricbeat/module/windows/perfmon/data_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,82 @@ func TestGroupToSingleEvent(t *testing.T) {
assert.Equal(t, val, mapstr.M{"processor_count": float64(2)})
}

func TestMatchByParentInstance(t *testing.T) {
_true := true
_false := false
reader := Reader{
query: pdh.Query{},
log: nil,
config: Config{
MatchByParentInstance: &_true,
},
counters: []PerfCounter{
{
QueryField: "%_processor_time",
QueryName: `\Processor Information(*)\% Processor Time`,
Format: "float",
ObjectName: "Processor Information",
ObjectField: "object",
InstanceName: "*",
InstanceField: "instance",
ChildQueries: []string{`\Processor Information(processor)\% Processor Time`, `\Processor Information(processor#1)\% Processor Time`},
},
},
}

counters := map[string][]pdh.CounterValue{
`\Processor Information(processor)\% Processor Time`: {
{
Instance: "processor",
Measurement: 23,
},
},
`\Processor Information(processor#1)\% Processor Time`: {
{
Instance: "processor#1",
Measurement: 21,
},
},
}

{
events := reader.groupToEvents(counters)
assert.NotNil(t, events)
assert.Equal(t, 2, len(events))
ok, err := events[0].MetricSetFields.HasKey("instance")
assert.NoError(t, err)
assert.True(t, ok)
ok, err = events[1].MetricSetFields.HasKey("instance")
assert.NoError(t, err)
assert.True(t, ok)
val1, err := events[0].MetricSetFields.GetValue("instance")
assert.NoError(t, err)
assert.Equal(t, val1, "processor")
val2, err := events[1].MetricSetFields.GetValue("instance")
assert.NoError(t, err)
assert.Equal(t, val2, "processor")
}

reader.config.MatchByParentInstance = &_false
{
events := reader.groupToEvents(counters)
assert.NotNil(t, events)
assert.Equal(t, 2, len(events))
ok, err := events[0].MetricSetFields.HasKey("instance")
assert.NoError(t, err)
assert.True(t, ok)
ok, err = events[1].MetricSetFields.HasKey("instance")
assert.NoError(t, err)
assert.True(t, ok)
val1, err := events[0].MetricSetFields.GetValue("instance")
assert.NoError(t, err)
assert.Equal(t, val1, "processor")
val2, err := events[1].MetricSetFields.GetValue("instance")
assert.NoError(t, err)
assert.Equal(t, val2, "processor#1")
}
}

func TestMatchesParentProcess(t *testing.T) {
ok, val := matchesParentProcess("svchost")
assert.True(t, ok)
Expand Down

0 comments on commit cb01a9e

Please sign in to comment.