Perfmon should generate unified static layout events for each performance monitor

[vbohata]

I think the best would be to generate single event per performance counter value and use pre-defined field names so the result could look like this:
{
"windows": {
"perfmon": {
"category" : ".NET CLR Exceptions",
"instance" : "??APP_CLR_PROC??",
"name" : "my_counter_name",
"value" : 0.0
}
}
}

There are many advantages:

1. Allows term aggregations per category, name ...
2. Allows easy filtering results for known category, name, ... No need for searching available fields.
3. Avoids possible huge number of dynamic fields.
4. With a little modification can be part of the ECS.
5. In environments/companies with mix of metricbeat, 3rd party and custom log shippers allows easily mixing the data searching via Kibana.

Our use case: large number of teams, some of them managing metricbeat configuration by themselves. Large number of perfcounters. Each new counter requires us to refresh the Kibana index pattern mapping, also it is not possible to find the perfcounter by name, ...

I also commented it here:
#6584 (comment)

[narph]

@vbohata , although this is a year long issue, you might want to have a look at #17596, as it satisfies most of your requests, let us know what you think.

[vbohata]

Looks definitely better.

Pros:

• can be queried much better
• is compact

Cons:

• can not do aggregations on metrics names to return values like "time_processor_pct"

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!