From 4ebe83873814dcd704fa4ea465cc7b56fcdae3c3 Mon Sep 17 00:00:00 2001 From: Stefan Stas Date: Wed, 26 Nov 2025 08:37:09 +0000 Subject: [PATCH 1/2] test --- .../iis/application_pool/application_pool.go | 2 + .../module/iis/application_pool/reader.go | 39 ++++++++++++------- 2 files changed, 28 insertions(+), 13 deletions(-) diff --git a/x-pack/metricbeat/module/iis/application_pool/application_pool.go b/x-pack/metricbeat/module/iis/application_pool/application_pool.go index 865246011cb7..729717b8a686 100644 --- a/x-pack/metricbeat/module/iis/application_pool/application_pool.go +++ b/x-pack/metricbeat/module/iis/application_pool/application_pool.go @@ -76,6 +76,8 @@ func (m *MetricSet) Fetch(report mb.ReporterV2) error { return fmt.Errorf("failed reading counters: %w", err) } + m.Logger().Infof("post_events: %+v", events) + for _, event := range events { isOpen := report.Event(event) if !isOpen { diff --git a/x-pack/metricbeat/module/iis/application_pool/reader.go b/x-pack/metricbeat/module/iis/application_pool/reader.go index ef0d373aace4..f1beb821df19 100644 --- a/x-pack/metricbeat/module/iis/application_pool/reader.go +++ b/x-pack/metricbeat/module/iis/application_pool/reader.go @@ -79,6 +79,8 @@ var appPoolCounters = map[string]string{ // .NET CLR LocksAndThreads "net_clr.locks_and_threads.contention_rate_per_sec": "\\.NET CLR LocksAndThreads(w3wp*)\\Contention Rate / sec", "net_clr.locks_and_threads.current_queue_length": "\\.NET CLR LocksAndThreads(w3wp*)\\Current Queue Length", + + "test_state": "\\APP_POOL_WAS(*)\\Current Application Pool State", } // newReader creates a new instance of Reader. @@ -145,9 +147,18 @@ func (r *Reader) initAppPools() error { continue } for _, v := range childQueries { - if err := r.query.AddCounter(v, "", "float", len(childQueries) > 1); err != nil { - return fmt.Errorf(`failed to add counter (query="%v"): %w`, v, err) + if key == "test_state.state" { + if err := r.query.AddCounter(v, "", "long", len(childQueries) > 1); err != nil { + r.log.Infof("FAILED_COUNTER: %+v", err) + return fmt.Errorf(`failed to add counter (query="%v"): %w`, v, err) + } + r.log.Infof("ADDED_COUNTER: %+v", r.query.Counters) + } else { + if err := r.query.AddCounter(v, "", "float", len(childQueries) > 1); err != nil { + return fmt.Errorf(`failed to add counter (query="%v"): %w`, v, err) + } } + r.workerProcesses[v] = key } } @@ -155,15 +166,16 @@ func (r *Reader) initAppPools() error { if err != nil { return fmt.Errorf("failed removing unused counter values: %w", err) } + return nil } // read executes a query and returns those values in an event. func (r *Reader) read() ([]mb.Event, error) { - if len(r.applicationPools) == 0 { - r.executed = true - return nil, nil - } + // if len(r.applicationPools) == 0 { + // r.executed = true + // return nil, nil + // } // Some counters, such as rate counters, require two counter values in order to compute a displayable value. In this case we must call PdhCollectQueryData twice before calling PdhGetFormattedCounterValue. // For more information, see Collecting Performance Data (https://docs.microsoft.com/en-us/windows/desktop/PerfCtrs/collecting-performance-data). @@ -188,7 +200,7 @@ func (r *Reader) read() ([]mb.Event, error) { } func (r *Reader) mapEvents(values map[string][]pdh.CounterValue) map[string]mb.Event { - workers := getProcessIds(values) + // workers := getProcessIds(values) events := make(map[string]mb.Event) for _, appPool := range r.applicationPools { events[appPool.name] = mb.Event{ @@ -197,6 +209,7 @@ func (r *Reader) mapEvents(values map[string][]pdh.CounterValue) map[string]mb.E }, RootFields: mapstr.M{}, } + for counterPath, value := range values { for _, val := range value { // Some counters, such as rate counters, require two counter values in order to compute a displayable value. In this case we must call PdhCollectQueryData twice before calling PdhGetFormattedCounterValue. @@ -214,13 +227,13 @@ func (r *Reader) mapEvents(values map[string][]pdh.CounterValue) map[string]mb.E continue } } - if hasWorkerProcess(val.Instance, workers, appPool.workerProcessIds) { - if r.workerProcesses[counterPath] == ecsProcessId { - events[appPool.name].RootFields.Put(r.workerProcesses[counterPath], val.Measurement) - } else if len(r.workerProcesses[counterPath]) != 0 { - events[appPool.name].MetricSetFields.Put(r.workerProcesses[counterPath], val.Measurement) - } + // if hasWorkerProcess(val.Instance, workers, appPool.workerProcessIds) { + if r.workerProcesses[counterPath] == ecsProcessId { + events[appPool.name].RootFields.Put(r.workerProcesses[counterPath], val.Measurement) + } else if len(r.workerProcesses[counterPath]) != 0 { + events[appPool.name].MetricSetFields.Put(r.workerProcesses[counterPath], val.Measurement) } + // } } } } From 27551e83887040d55034200663761d7bfb799bb7 Mon Sep 17 00:00:00 2001 From: Stefan Stas Date: Thu, 27 Nov 2025 11:23:47 +0000 Subject: [PATCH 2/2] test --- .../iis/application_pool/_meta/fields.yml | 2 ++ .../module/iis/application_pool/reader.go | 24 +++++++++---------- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/x-pack/metricbeat/module/iis/application_pool/_meta/fields.yml b/x-pack/metricbeat/module/iis/application_pool/_meta/fields.yml index 94f020da8ccd..61552fcb78e0 100644 --- a/x-pack/metricbeat/module/iis/application_pool/_meta/fields.yml +++ b/x-pack/metricbeat/module/iis/application_pool/_meta/fields.yml @@ -136,3 +136,5 @@ type: float description: > Current Queue Length. + - name: "state" + type: long diff --git a/x-pack/metricbeat/module/iis/application_pool/reader.go b/x-pack/metricbeat/module/iis/application_pool/reader.go index f1beb821df19..22f9aac23917 100644 --- a/x-pack/metricbeat/module/iis/application_pool/reader.go +++ b/x-pack/metricbeat/module/iis/application_pool/reader.go @@ -80,7 +80,7 @@ var appPoolCounters = map[string]string{ "net_clr.locks_and_threads.contention_rate_per_sec": "\\.NET CLR LocksAndThreads(w3wp*)\\Contention Rate / sec", "net_clr.locks_and_threads.current_queue_length": "\\.NET CLR LocksAndThreads(w3wp*)\\Current Queue Length", - "test_state": "\\APP_POOL_WAS(*)\\Current Application Pool State", + "state": "\\APP_POOL_WAS(*)\\Current Application Pool State", } // newReader creates a new instance of Reader. @@ -172,10 +172,10 @@ func (r *Reader) initAppPools() error { // read executes a query and returns those values in an event. func (r *Reader) read() ([]mb.Event, error) { - // if len(r.applicationPools) == 0 { - // r.executed = true - // return nil, nil - // } + if len(r.applicationPools) == 0 { + r.executed = true + return nil, nil + } // Some counters, such as rate counters, require two counter values in order to compute a displayable value. In this case we must call PdhCollectQueryData twice before calling PdhGetFormattedCounterValue. // For more information, see Collecting Performance Data (https://docs.microsoft.com/en-us/windows/desktop/PerfCtrs/collecting-performance-data). @@ -200,7 +200,7 @@ func (r *Reader) read() ([]mb.Event, error) { } func (r *Reader) mapEvents(values map[string][]pdh.CounterValue) map[string]mb.Event { - // workers := getProcessIds(values) + workers := getProcessIds(values) events := make(map[string]mb.Event) for _, appPool := range r.applicationPools { events[appPool.name] = mb.Event{ @@ -227,13 +227,13 @@ func (r *Reader) mapEvents(values map[string][]pdh.CounterValue) map[string]mb.E continue } } - // if hasWorkerProcess(val.Instance, workers, appPool.workerProcessIds) { - if r.workerProcesses[counterPath] == ecsProcessId { - events[appPool.name].RootFields.Put(r.workerProcesses[counterPath], val.Measurement) - } else if len(r.workerProcesses[counterPath]) != 0 { - events[appPool.name].MetricSetFields.Put(r.workerProcesses[counterPath], val.Measurement) + if hasWorkerProcess(val.Instance, workers, appPool.workerProcessIds) || val.Instance == appPool.name { + if r.workerProcesses[counterPath] == ecsProcessId { + events[appPool.name].RootFields.Put(r.workerProcesses[counterPath], val.Measurement) + } else if len(r.workerProcesses[counterPath]) != 0 { + events[appPool.name].MetricSetFields.Put(r.workerProcesses[counterPath], val.Measurement) + } } - // } } } }