Type to search.

Windows fields

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Module for Windows

windows

perfmon

perfmon

windows.perfmon.instance

Instance value.

type: keyword

windows.perfmon.metrics.*.*

Metric values returned.

type: object

service

service contains the status for Windows services.

windows.service.id

A unique ID for the service. It is a hash of the machine's GUID and the service name.

type: keyword

example: hW3NJFc1Ap

windows.service.name

The service name.

type: keyword

example: Wecsvc

windows.service.display_name

The display name of the service.

type: keyword

example: Windows Event Collector

windows.service.start_type

The startup type of the service. The possible values are Automatic, Boot, Disabled, Manual, and System.

type: keyword

windows.service.start_name

Account name under which a service runs.

type: keyword

example: NT AUTHORITY\LocalService

windows.service.path_name

Fully qualified path to the file that implements the service, including arguments.

type: keyword

example: C:\WINDOWS\system32\svchost.exe -k LocalService -p

windows.service.state

The actual state of the service. The possible values are Continuing, Pausing, Paused, Running, Starting, Stopping, and Stopped.

type: keyword

windows.service.exit_code

For Stopped services this is the error code that service reports when starting to stopping. This will be the generic Windows service error code unless the service provides a service-specific error code.

type: keyword

windows.service.pid

For Running services this is the associated process PID.

type: long

example: 1092

windows.service.uptime.ms

The service's uptime specified in milliseconds.

type: long

format: duration

wmi

Stack Beta 9.1+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Beta since 9.1

    This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

wmi