Windows Agent: multiple instances localization when use UseWildcardsExpansion = true

[runningAgain]

Feature Request

Option to get always fields in english language

Current behavior:

With UseWildcardsExpansion = true to get all instances of a process like chrome or svchost , field are in local language like german

Without UseWildcardsExpansion = true , we only get one instance of chrome or svchost but fields are in english language.

Desired behavior:

With UseWildcardsExpansion = true to get all instances of a process like chrome or svchost , field are in english language

Use case: [Why is this important (helps with prioritizing requests)]

this is very important, because we startet our telegraf usage on many clients a long time before. so all of our data are used on english language. if now we want to use UseWildcardsExpansion = true to get all intances of a process new fileds/value are generated, example Working_Set is now Arbeitsseiten.

before:

win_proc,host=XXXXXXXX,instance=svchost,objectname=Process Handle_Count=78,IO_Read_Bytes_persec=0,IO_Write_Bytes_perse
c=0,Page_Faults_persec=0,Percent_Processor_Time=0,Pool_Paged_Bytes=92352,Private_Bytes=2088960,Working_Set=6049792 1540274701000000000

after:

win_proc,host=XXXXXXXX,instance=svchost,objectname=Prozess Arbeitsseiten=14057472,Auslagerungsseiten_(Bytes)=136224,E/
A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=427,Private_Bytes=6144000,Prozessorzeit_(Percent)=0,Seitenfehler/s=2.9842305183410645 154027463700000
0000
win_proc,host=XXXXXXXX,instance=svchost#6,objectname=Prozess Arbeitsseiten=18944000,Auslagerungsseiten_(Bytes)=174952,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=409,Private_Bytes=9633792,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#1,objectname=Prozess Arbeitsseiten=12558336,Auslagerungsseiten_(Bytes)=147168,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=426,Private_Bytes=6328320,Prozessorzeit_(Percent)=1.552093505859375,Seitenfehler/s=6.96320438385009
8 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#5,objectname=Prozess Arbeitsseiten=28954624,Auslagerungsseiten_(Bytes)=195312,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=298,Private_Bytes=15454208,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#3,objectname=Prozess Arbeitsseiten=13623296,Auslagerungsseiten_(Bytes)=156696,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=223,Private_Bytes=4677632,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#8,objectname=Prozess Arbeitsseiten=21245952,Auslagerungsseiten_(Bytes)=143392,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=328,Private_Bytes=16576512,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#4,objectname=Prozess Arbeitsseiten=37974016,Auslagerungsseiten_(Bytes)=230040,
E/A-Bytes_gelesen/s=16297.8779296875,E/A-Bytes_geschrieben/s=0,Handleanzahl=1105,Private_Bytes=22503424,Prozessorzeit_(Percent)=0,Seitenfehler/s=170.10113525390
625 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#9,objectname=Prozess Arbeitsseiten=6049792,Auslagerungsseiten_(Bytes)=92352,E/
A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=78,Private_Bytes=2088960,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#7,objectname=Prozess Arbeitsseiten=25780224,Auslagerungsseiten_(Bytes)=216568,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=691,Private_Bytes=18444288,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000
win_proc,host=XXXXXXXX,instance=svchost#2,objectname=Prozess Arbeitsseiten=25202688,Auslagerungsseiten_(Bytes)=159096,
E/A-Bytes_gelesen/s=0,E/A-Bytes_geschrieben/s=0,Handleanzahl=534,Private_Bytes=22151168,Prozessorzeit_(Percent)=0,Seitenfehler/s=0 1540274637000000000

[danielnelson]

This is unwanted behavior but its seems to be a limitation of performance counters. I wonder though if it could be fixed by changing the locale in process or if a user could be setup to run Telegraf with a different locale.

@runningAgain Maybe you could try this?
https://superuser.com/questions/905522/how-to-launch-a-64-bit-program-with-a-different-locale-than-the-system-locale

[runningAgain]

there is no way to get this simply running. the only way to do this on windows 7 is to reinstall os with new language settings. on some environments this could be tricky ;-)

By the way .. another idea ... is there a working processor plugin to rename the measurements ? I've seen there is a processor plugin called rename but how this works on windows client ?

[glinton]

I believe the rename processor works the same on the windows client as documented:

[[processors.rename]]
  ## Specify one sub-table per rename operation.
  [[processors.rename.replace]]
    measurement = "network_interface_throughput"
    dest = "throughput"

[runningAgain]

It seems that the rename processor is not working on windows platform ?
I use the following settings in my config.

[[processors.rename]]
[[processors.rename.replace]]
measurement = "win_proc"
dest = "winprocess"

In the Output the measurement is the same as before. Is the rename processor plugin integrated in windows platform?

[danielnelson]

This should be working on Windows, it seems unlikely that this would be platform issue, though I haven't checked. One potential gotcha is that the --test command doesn't currently run the processors, you will have to run Telegraf normally to see the changes.

[runningAgain]

Hi Daniel,
thanks for quick response. Agree, with option --test the processors not running. I've configured this on windows platform service and renaming works fine :-)
So now we can rename our "other than english language" fields to original, english system language.
Nice workaround for fields.

However, windows platform counters has also an tag - "ObjectName". The value of this is also in "non system language". Example:

ObjectName = Memory
vs.
ObjectName = Arbeitspeicher

I'll try to rename this with strings processor - replace. Can anyone give me an example ? Is this also working on windows platform ?

[danielnelson]

Here is an example, I included the namepass option mostly for performance reasons, this will allow the plugin to skip over metrics from other plugins more quickly:

[[processors.strings]]
  namepass = "win_proc"
  [[processors.strings.replace]]
    tag = "ObjectName"
    old = "Arbeitspeicher"
    new = "Memory"

[runningAgain]

Hi Daniel,

i've test your example and get the following error.

2018-12-21T07:25:21Z I! Starting Telegraf 1.9.1
2018-12-21T07:25:21Z E! [telegraf] Error running agent: Error parsing .\telegraf
.conf, line 159: field corresponding to namepass' is not defined in *strings.c
onverter'

config as followed ....

[[processors.strings]]
namepass = "win_mem"
[[processors.strings.replace]]
Tag = "objectname"
Old = "Arbeitsspeicher"
New = "Memory"
namepass = "win_cpu" <- this is line 159
[[processors.strings.replace]]
tag = "ObjectName"
old = "Prozessorinformationen"
new = "Processor Information"
namepass = "win_disk"
[[processors.strings.replace]]
tag = "ObjectName"
old = "Logischer Datenträger"
new = "LogicalDisk"
namepass = "win_diskio"
[[processors.strings.replace]]
tag = "ObjectName"
old = "Physikalischer Datenträger"
new = "PhysicalDisk"
namepass = "win_proc"
[[processors.strings.replace]]
tag = "ObjectName"
old = "Prozess"
new = "Process"

[runningAgain]

.... now it's working ....

In difference to replace processor the strings processor needs for each "replace" an seperate [[processors.strings]] section, like ...

[[processors.strings]]
namepass = "win_mem"
[[processors.strings.replace]]
tag = "objectname"
old = "Arbeitsspeicher"
new = "Memory"
[[processors.strings]]
namepass = "win_cpu"
[[processors.strings.replace]]
tag = "objectname"
old = "Prozessorinformationen"
new = "Processor Information"

... however it works. Thanks for this.

[danielnelson]

@runningAgain I have a fix for that in #5195, one more thing that was wrong in my example config: namepass should be an array of patterns:

[[processors.strings]]
  namepass = ["win_mem"]
  [[processors.strings.replace]]
    tag = "objectname"
    old = "Arbeitsspeicher"
    new = "Memory"