Metricbeat Windows Module invalid windows.yml in modules.d

[jeffpatton1971]

The default windows.yml located in modules.d contains an invalid query that when enabled prevents the metricbeat service from starting.

PS C:\Program Files\metricbeat> cat .\modules.d\windows.yml
# Module: windows
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.10/metricbeat-module-windows.html

- module: windows
  metricsets:
    - service
  period: 1m

- module: windows
  metricsets:
  - perfmon
  period: 10s
  perfmon.queries:
   - object: 'Process'
     instance: ["*"]
     counters:
     - name: 'Disk Writes/sec'
       field: physical_disk.write.per_sec
       format: "float"
     - name: "% Disk Write Time"
PS C:\Program Files\metricbeat> Start-Service metricbeat
Start-Service : Failed to start service 'metricbeat (metricbeat)'.
At line:1 char:1
+ Start-Service metricbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
    + FullyQualifiedErrorId : StartServiceFailed,Microsoft.PowerShell.Commands.StartServiceCommand

Note the query object is process, yet the counters are all disk related. After changing these to the sample shown on the following page https://www.elastic.co/guide/en/beats/metricbeat/7.10/metricbeat-module-windows.html and uncommenting the process queries, the service was able to successfully start.

It would be helpful if we could get this fixed as it took me longer than it should have to run this down as the error message coming back from windows was less than helpful.

metricbeat.modules:
- module: windows
  metricsets: ["perfmon"]
  enabled: true
  period: 10s
  perfmon.ignore_non_existent_counters: false
  perfmon.group_measurements_by_instance: false
  perfmon.queries:
#  - object: 'Process'
#    instance: ["*"]
#    counters:
#    - name: '% Processor Time'
#      field: cpu_usage
#      format: "float"
#    - name: "Thread Count"

- module: windows
  metricsets: ["service"]
  enabled: true
  period: 60s

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[jeffpatton1971]

FWIW there may be a similar issue with the Azure module as well, but I wasn't entirely certain I was passing in the SPN creds properly or not and I've not had time to get back to it this week.

[narph]

@jeffpatton1971 we had some legacy code we mistakenly ignored, all updated now with #23327.
Not sure what do you mean by the same case with the azure module, can you expand on that.

[leandroscardua]

Hi Elastic Team,

Does anyone has roadmap and timeline to fix it?