I wanted to confirm behavior seen in Metricbeat with Perfmon as seen in the discuss url below. This relates to instances that have parenthesis and # in the interface description for Windows systems.

Get-NetAdapter|fl Name,InterfaceDescription

Name                 : vEthernet (HV Public)
InterfaceDescription : Hyper-V Virtual Ethernet Adapter #2

Name                 : Ethernet 4
InterfaceDescription : Intel(R) I211 Gigabit Network Connection #2

In this case, the below configuration will provide incorrect values for the field windows.perfmon.instance. They will be presented as

• Hyper-V Virtual Ethernet Adapter
• Intel(R

This isn't ideal as both the nic identifying number is lost as well as the full name of the instance if there is a closing ) involved. There appears to be a similar, but closed issue as noted in the discuss url and is #9835. I understand the reason for closing it with processes and preserving start order, this isn't the case for NICs and when troubleshooting resource issues with NICs and RSS queues this information that is needed gets lost from Metricbeat.

Metricbeat

• Version: 7.9.0 7.9.1
• Operating System: Windows Server 2012 - 2019
• Discuss Forum URL: https://discuss.elastic.co/t/metricbeat-windows-module-perfmon-instances-truncated-with-parenthesis/248422
• Steps to Reproduce:

1. Configure metricbeat windows perfmon module

    - module: windows
      metricsets:
      - perfmon
      period: 15s
      perfmon.group_measurements_by_instance: true
      perfmon.queries:
       - object: 'Per Processor Network Interface Card Activity'
         instance: ["*"]
         counters:
         - name: 'DPCs Queued/sec'
           field: per_processor_network_interface.dpcs_queued.per_sec
           format: "float"
       - object: 'Processor'
         instance: ["*"]
         counters:
         - name: 'DPCs Queued/sec'
           field: processor.dpcs_queued.per_sec
           format: "float"
         - name: '% DPC Time'
           field: processor.pct_dpc_time
           format: "float"

2. Run metricbeat and check elasticsearch