Use transform to add key values to windows host metric events

[abubakr-cgs]

Hello, I am currently fetching host metrics to ingest windows performance logs

sources:
  win_hostmetrics:
    type: "host_metrics"
    scrape_interval_secs: 10
    filesystem:
      devices:
        excludes: ["C:\\pagefile.sys"]
    disk:
      devices:
        excludes: ["C:\\pagefile.sys"]

I am trying to use transform to add 2 new keys explicitly "dt" and "message" to every event through vector, like below:

transforms:
  parse_win_hostmetrics:
    type: "remap"
    inputs: ["win_hostmetrics"]
    source: |
      .dt = .timestamp
      .message = {"Windows Host Metric Event"}

I have tried alternate ways such as encoding to json or merging as well, but it does not work.
But the transform is never applied, although if i give del(.timestamp), the timestamp variable gets removed: sample output below.

...}
{
  "name": "memory_swap_total_bytes",
  "tags": {
    "host": "DESKTOP-F1VAVE8"
  },
  "kind": "absolute",
  "gauge": {
    "value": 13455073280.0
  }
}
{...

Is this an issue or am I doing something wrong? Any help would be appreciated, thanks!

[pront]

Hi @abubakr-cgs, you cannot modify metrics in the way you describe. You can see all supported operations on a metric event here: https://vector.dev/docs/reference/configuration/transforms/remap/#event-data-model

For example, you can add a tag for "Windows Host Metric Event". But you cannot add arbitrary paths like you can do for logs.

[abubakr-cgs]

Thank you, I'm currently using metric_to_log transform and it works.

transforms:
  convert_metric_to_log:
    type: "metric_to_log"
    inputs: [win_hostmetrics]
    metric_tag_values: single