[Metricbeat] Windows Module add wmi metricset

[herrBez]

Proposed commit message

[Metricbeat][Windows] Add experimental wmi metricset

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

This PR does not have impact to existing use-cases

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Move WMI metric capture from Logstash to metric beats #29072
• Collect SMART data with metricbeat #8614
• [External] [Feature] Metricbeat Support/Migration eskibars/wmibeat#4

Use cases

As a windows user I want to leverage WMI (and in particular WQL, SQL for WMI) to extract detailed system information and metrics.

Screenshots

Logs

[botelastic]

This pull request doesn't have a Team:<team> label.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @herrBez? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

[strawgate]

One of the challenges with running arbitrary WMI queries is that WMI queries can be extremely slow and certain WMI queries can actually result in changes to the system -- have we considered whether or how we might provide timeout functionality for running WMI queries?

[herrBez]

Hi, good points! Thank you for the comment :).

One of the challenges with running arbitrary WMI queries is that WMI queries can be extremely slow and certain WMI queries can actually result in changes to the system -- have we considered whether or how we might provide timeout functionality for running WMI queries?

About the timing issues: I don't see a parameter in the library to stop a query after X seconds (I would need to understand if the underlying library/WMI have a similar mechanism). Maybe by leveraging an ExecAsyncQuery (there is no "exposed" method for this) we can stop after a timeout. Similarly to what is done here: https://github.com/microsoft/wmi/blob/v0.25.0/pkg/wmiinstance/WmiEventSink_test.go#L66. Not sure it's actually stopping the underlying query after some time.

About the "can actually result in changes to the system": with the current implementation we can only build queries of type SELECT * FROM Class WHERE .... This should prevent changes to the system, right?

[herrBez]

Hi @ishleenk17, @tommyers-elastic , I implemented all changes we discussed offline and the dataset is ready for review.

I am having a very hard-time in making the CI/CD pipeline work. Could you help me shred some lights? In particular, I am not able to understand how to fix the error reported here https://github.com/elastic/beats/actions/runs/12483185235/job/34838540533?pr=42017.

[ishleenk17]

@herrBez

• To make this module part of the Agent, please add the module to agenbeat.spec.yml .
• Please run make update BEATS=metricbeat in the beats directory.

[herrBez]

Hi Ishleen, thank you for the help.

Please run make update BEATS=metricbeat in the beats directory.

I receive the error as part of the execution of the command and I don't understand how to fix it.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b wmi upstream/wmi
git merge upstream/main
git push upstream wmi