Cherry-pick #23505 to 7.11: [fix][metricbeat]Fix metricbeat/perfmon measurement grouping

[marc-gr]

Cherry-pick of PR #23505 and #23617 to 7.11 branch. Original message:

What does this PR do?

Fixes measurement grouping on metricbeat windows/perfmon.

Why is it important?

Counter from different metric objects were being mixed when measurement grouping was enabled.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Logs

With a config like:

metricbeat.modules:
  - module: windows
    metricsets: [perfmon]
    period: 10s
    perfmon.ignore_non_existent_counters: false
    perfmon.group_measurements_by_instance: true
    perfmon.queries:

    - object: "Processor Information"
      instance: "_Total"
      counters:
      - name: "% Processor Time"

    - object: "PhysicalDisk"
      instance: "_Total"
      counters:
      - name: "Current Disk Queue Length"
      - name: "Disk Read Bytes/sec"
      - name: "Disk Write Bytes/sec"

output.console:
  pretty: true

We were getting an output like:

{
  "@timestamp": "2021-01-13T15:27:09.161Z",
  "@metadata": {
    "beat": "metricbeat",
    "type": "_doc",
    "version": "8.0.0"
  },
  "event": {
    "dataset": "windows.perfmon",
    "module": "windows",
    "duration": 8027600
  },
  "metricset": {
    "name": "perfmon",
    "period": 10000
  },
  "service": {
    "type": "windows"
  },
  "windows": {
    "perfmon": {
      "metrics": {
        "disk_write_bytes_per_sec": 8381.215716061084,
        "%_processor_time": 0.10681524439283274,
        "current_disk_queue_length": 0,
        "disk_read_bytes_per_sec": 0
      },
      "object": "PhysicalDisk",
      "instance": "_Total"
    }
  },
  "host": {
    "name": "vagrant"
  },
  "agent": {
    "type": "metricbeat",
    "version": "8.0.0",
    "ephemeral_id": "e3c6902f-c539-4517-a0be-74d700709309",
    "id": "5159c10f-36f4-4489-9a9b-3a82cbd924d7",
    "name": "vagrant"
  },
  "ecs": {
    "version": "1.7.0"
  }
}

Note %_processor_time being merged with PhysicalDisk object metrics.

After the fix we get the following output instead:

{
  "@timestamp": "2021-01-14T10:56:06.684Z",
  "@metadata": {
    "beat": "metricbeat",
    "type": "_doc",
    "version": "8.0.0"
  },
  "event": {
    "duration": 5860100,
    "dataset": "windows.perfmon",
    "module": "windows"
  },
  "metricset": {
    "name": "perfmon",
    "period": 10000
  },
  "service": {
    "type": "windows"
  },
  "windows": {
    "perfmon": {
      "instance": "_Total",
      "metrics": {
        "current_disk_queue_length": 0,
        "disk_read_bytes_per_sec": 0,
        "disk_write_bytes_per_sec": 15860.12885215545
      },
      "object": "PhysicalDisk"
    }
  },
  "ecs": {
    "version": "1.7.0"
  },
  "host": {
    "name": "vagrant"
  },
  "agent": {
    "version": "8.0.0",
    "ephemeral_id": "4a737200-e1be-4d13-9eb5-cb81249f4a7f",
    "id": "5159c10f-36f4-4489-9a9b-3a82cbd924d7",
    "name": "vagrant",
    "type": "metricbeat"
  }
}
{
  "@timestamp": "2021-01-14T10:56:06.684Z",
  "@metadata": {
    "beat": "metricbeat",
    "type": "_doc",
    "version": "8.0.0"
  },
  "metricset": {
    "period": 10000,
    "name": "perfmon"
  },
  "ecs": {
    "version": "1.7.0"
  },
  "host": {
    "name": "vagrant"
  },
  "agent": {
    "version": "8.0.0",
    "ephemeral_id": "4a737200-e1be-4d13-9eb5-cb81249f4a7f",
    "id": "5159c10f-36f4-4489-9a9b-3a82cbd924d7",
    "name": "vagrant",
    "type": "metricbeat"
  },
  "service": {
    "type": "windows"
  },
  "windows": {
    "perfmon": {
      "instance": "_Total",
      "metrics": {
        "%_processor_time": 0.1124404001576429
      },
      "object": "Processor Information"
    }
  },
  "event": {
    "dataset": "windows.perfmon",
    "module": "windows",
    "duration": 5860100
  }
}

Now we get a different event for each object.

Fixes #23489

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #23611 updated

• • Start Time: 2021-01-21T16:19:10.139+0000

• Duration: 31 min 40 sec

• Commit: fa98608

Test stats 🧪

Test	Results
Failed	0
Passed	8649
Skipped	2122
Total	10771

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	8649
Skipped	2122
Total	10771

[v1v]

I just added some windows labels to validate this particular change for all the supported versions of Windows.

/test

[narph]

LGTM