PdhExpandWildCardPathW will not expand counter paths in 32 bit windows systems

CHANGELOG.next.asciidoc

@@ -133,6 +133,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - The `elasticsearch/index_summary` metricset gracefully handles an empty Elasticsearch cluster when `xpack.enabled: true` is set. {pull}12489[12489] {issue}12487[12487]
 - When TLS is configured for the http metricset and a `certificate_authorities` is configured we now default to `required` for the `client_authentication`. {pull}12584[12584]
 - Reuse connections in PostgreSQL metricsets. {issue}12504[12504] {pull}12603[12603]
+- PdhExpandWildCardPathW will not expand counter paths in 32 bit windows systems, workaround will use a different function.{issue}12590[12590]{pull}12622[12622]
 
 *Packetbeat*
 

metricbeat/module/windows/perfmon/pdh_integration_windows_test.go

@@ -46,14 +46,14 @@ func TestData(t *testing.T) {
 				"query":             `\Processor Information(_Total)\% Processor Time`,
 			},
 			{
-				"instance_label":    "disk.bytes.name",
-				"measurement_label": "disk.bytes.read.total",
-				"query":             `\FileSystem Disk Activity(_Total)\FileSystem Bytes Read`,
+				"instance_label":    "process.name",
+				"measurement_label": "process.ID",
+				"query":             `\Process(_Total)\ID Process`,
 			},
 			{
 				"instance_label":    "processor.name",
-				"measurement_label": "processor.time.idle.average.ns",
-				"query":             `\Processor Information(_Total)\Average Idle Time`,
+				"measurement_label": "processor.time.user.ns",
+				"query":             `\Processor Information(_Total)\% User Time`,
 			},
 		},
 	}
@@ -389,8 +389,8 @@ func TestGroupByInstance(t *testing.T) {
 	config.CounterConfig[1].Format = "float"
 
 	config.CounterConfig[2].InstanceLabel = "processor.name"
-	config.CounterConfig[2].MeasurementLabel = "processor.time.idle.average.ns"
-	config.CounterConfig[2].Query = `\Processor Information(_Total)\Average Idle Time`
+	config.CounterConfig[2].MeasurementLabel = "processor.time.privileged.ns"
+	config.CounterConfig[2].Query = `\Processor Information(_Total)\% Privileged Time`
 	config.CounterConfig[2].Format = "float"
 
 	handle, err := NewReader(config)
@@ -423,7 +423,7 @@ func TestGroupByInstance(t *testing.T) {
 	}
 	assert.True(t, pctKey)
 
-	pctKey, err = values[0].MetricSetFields.HasKey("processor.time.idle.average.ns")
+	pctKey, err = values[0].MetricSetFields.HasKey("processor.time.privileged.ns")
 	if err != nil {
 		t.Fatal(err)
 	}

metricbeat/module/windows/perfmon/pdh_query_windows.go

@@ -21,6 +21,7 @@ package perfmon
 
 import (
 	"regexp"
+	"runtime"
 	"syscall"
 	"unsafe"
 
@@ -114,8 +115,18 @@ func (q *Query) ExpandWildCardPath(wildCardPath string) ([]string, error) {
 	if wildCardPath == "" {
 		return nil, errors.New("no query path given")
 	}
+	utfPath, err := syscall.UTF16PtrFromString(wildCardPath)
+	if err != nil {
+		return nil, err
+	}
+	var expdPaths []uint16
 
-	expdPaths, err := PdhExpandWildCardPath(wildCardPath)
+	// PdhExpandWildCardPath will not return the counter paths for windows 32 bit systems but PdhExpandCounterPath will.
+	if runtime.GOARCH == "386" {
+		expdPaths, err = PdhExpandCounterPath(utfPath)
+	} else {
+		expdPaths, err = PdhExpandWildCardPath(utfPath)
+	}
 	if err != nil {
 		return nil, err
 	}

metricbeat/module/windows/perfmon/pdh_windows.go

@@ -36,6 +36,7 @@ import (
 //sys _PdhGetFormattedCounterValueLong(counter PdhCounterHandle, format PdhCounterFormat, counterType *uint32, value *PdhCounterValueLong) (errcode error) [failretval!=0]= pdh.PdhGetFormattedCounterValue
 //sys _PdhCloseQuery(query PdhQueryHandle) (errcode error) [failretval!=0] = pdh.PdhCloseQuery
 //sys _PdhExpandWildCardPath(dataSource *uint16, wildcardPath *uint16, expandedPathList *uint16, pathListLength *uint32) (errcode error) [failretval!=0] = pdh.PdhExpandWildCardPathW
+//sys _PdhExpandCounterPath(wildcardPath *uint16, expandedPathList *uint16, pathListLength *uint32) (errcode error) [failretval!=0] = pdh.PdhExpandCounterPathW
 
 type PdhQueryHandle uintptr
 
@@ -140,23 +141,33 @@ func PdhGetFormattedCounterValueLong(counter PdhCounterHandle) (uint32, *PdhCoun
 }
 
 // PdhExpandWildCardPath returns counter paths that match the given counter path.
-func PdhExpandWildCardPath(wildCardPath string) ([]uint16, error) {
-	utfPath, err := syscall.UTF16PtrFromString(wildCardPath)
-	if err != nil {
-		return nil, err
-	}
+func PdhExpandWildCardPath(utfPath *uint16) ([]uint16, error) {
 	var bufferSize uint32
 	if err := _PdhExpandWildCardPath(nil, utfPath, nil, &bufferSize); err != nil {
 		if PdhErrno(err.(syscall.Errno)) != PDH_MORE_DATA {
 			return nil, PdhErrno(err.(syscall.Errno))
 		}
+		expandPaths := make([]uint16, bufferSize)
+		if err := _PdhExpandWildCardPath(nil, utfPath, &expandPaths[0], &bufferSize); err != nil {
+			return nil, PdhErrno(err.(syscall.Errno))
+		}
+		return expandPaths, nil
+	}
+	return nil, nil
+}
 
-		expdPaths := make([]uint16, bufferSize)
-		bufferSize = uint32(len(expdPaths))
-		if err := _PdhExpandWildCardPath(nil, utfPath, &expdPaths[0], &bufferSize); err != nil {
+// PdhExpandCounterPath returns counter paths that match the given counter path, for 32 bit windows.
+func PdhExpandCounterPath(utfPath *uint16) ([]uint16, error) {
+	var bufferSize uint32
+	if err := _PdhExpandCounterPath(utfPath, nil, &bufferSize); err != nil {
+		if PdhErrno(err.(syscall.Errno)) != PDH_MORE_DATA {
+			return nil, PdhErrno(err.(syscall.Errno))
+		}
+		expandPaths := make([]uint16, bufferSize)
+		if err := _PdhExpandCounterPath(utfPath, &expandPaths[0], &bufferSize); err != nil {
 			return nil, PdhErrno(err.(syscall.Errno))
 		}
-		return expdPaths, nil
+		return expandPaths, nil
 	}
 	return nil, nil
 }

metricbeat/module/windows/perfmon/pdh_windows_test.go

@@ -18,6 +18,7 @@
 package perfmon
 
 import (
+	"syscall"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -56,7 +57,9 @@ func TestPdhGetFormattedCounterValueInvalidCounter(t *testing.T) {
 
 // TestPdhExpandWildCardPathInvalidPath will test for invalid query path.
 func TestPdhExpandWildCardPathInvalidPath(t *testing.T) {
-	queryList, err := PdhExpandWildCardPath("sdfhsdhfd")
+	utfPath, err := syscall.UTF16PtrFromString("sdfhsdhfd")
+	assert.Nil(t, err)
+	queryList, err := PdhExpandWildCardPath(utfPath)
 	assert.Nil(t, queryList)
 	assert.EqualValues(t, err, PDH_INVALID_PATH)
 }
@@ -80,7 +83,11 @@ func TestPdhSuccessfulCounterRetrieval(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer PdhCloseQuery(queryHandle)
-	queryList, err := PdhExpandWildCardPath(validQuery)
+	utfPath, err := syscall.UTF16PtrFromString(validQuery)
+	if err != nil {
+		t.Fatal(err)
+	}
+	queryList, err := PdhExpandWildCardPath(utfPath)
 	if err != nil {
 		t.Fatal(err)
 	}

metricbeat/module/windows/perfmon/reader.go

@@ -22,6 +22,7 @@ package perfmon
 import (
 	"regexp"
 	"strconv"
+	"strings"
 
 	"github.com/pkg/errors"
 
@@ -74,9 +75,10 @@ func NewReader(config Config) (*Reader, error) {
 				return nil, errors.Wrapf(err, `failed to expand counter (query="%v")`, counter.Query)
 			}
 		}
-		if childQueries == nil || len(childQueries) == 0 {
+		// check if the pdhexpandcounterpath/pdhexpandwildcardpath functions have expanded the counter successfully.
+		if len(childQueries) == 0 || (len(childQueries) == 1 && strings.Contains(childQueries[0], "*")) {
 			query.Close()
-			return nil, errors.Wrapf(err, `failed to expand counter (query="%v")`, counter.Query)
+			return nil, errors.Errorf(`failed to expand counter (query="%v")`, counter.Query)
 		}
 		for _, v := range childQueries {
 			if err := query.AddCounter(v, counter, len(childQueries) > 1); err != nil {
@@ -108,7 +110,7 @@ func (r *Reader) Read() ([]mb.Event, error) {
 
 	for counterPath, values := range values {
 		for ind, val := range values {
-			//Some counters, such as rate counters, require two counter values in order to compute a displayable value. In this case we must call PdhCollectQueryData twice before calling PdhGetFormattedCounterValue.
+			// Some counters, such as rate counters, require two counter values in order to compute a displayable value. In this case we must call PdhCollectQueryData twice before calling PdhGetFormattedCounterValue.
 			// For more information, see Collecting Performance Data (https://docs.microsoft.com/en-us/windows/desktop/PerfCtrs/collecting-performance-data).
 			if val.Err != nil && !r.executed {
 				r.log.Debugw("Ignoring the first measurement because the data isn't ready",