[Metricbeat] Windows perfmon wildcard instance queries with one instance show instance name as asterisk

[aevalov]

Metricbeat 7.8.1, 7.9.2
Windows Server 2019

Config sample:

  - object: "Hyper-V Dynamic Memory VM"
    instance: "*"
    counters:
    - name: "Physical Memory"
    - name: "Current Pressure"  

For Hyper-V hosts with two or more VMs it's ok.

    "windows": {
      "perfmon": {
        "metrics": {
          "current_pressure": 41
        },
        "object": "Hyper-V Dynamic Memory VM",
        "instance": "vm2"
      }
    },

For Hyper-V hosts with one VM it's look like:

    "windows": {
      "perfmon": {
        "instance": "*",
        "metrics": {
          "current_pressure": 7
        },
        "object": "Hyper-V Dynamic Memory VM"
      }
    },

As you can see, an asterisk mark used for instance name. Obviously that is wrong instance name.

Powershell on Hyper-V host with one VM:

get-counter "\Hyper-V Dynamic Memory VM(*)\Current Pressure"

Timestamp                 CounterSamples
---------                 --------------
28.10.2020 11:19:51       \\srv\hyper-v dynamic memory vm(vm1)\current pressure :
                          10

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[narph]

hi @aevalov , thanks for bringing this to our attention, I was able to reproduce this issue:

		  PS C:\Users\...> Get-Counter -Counter "\Hyper-V Dynamic Memory VM(*)\Physical Memory"

Timestamp                 CounterSamples
---------                 --------------
10/29/2020 10:29:52 AM    \\desktop-...\hyper-v dynamic memory vm(ubuntu 20.04.1 lts)\physical memory :
                          1798

"windows" : {
            "perfmon" : {
              "metrics" : {
                "physical_memory" : 1876
              },
              "object" : "Hyper-V Dynamic Memory VM",
              "instance" : "*"
            }
          }

A fix for this behavior is found here #22261, no workarounds at the moment, unless you specify the name of the instance in the configuration file instead of the wildcard.