From 9f503147b613651c4bb1c75913f9ea6aaf51eac1 Mon Sep 17 00:00:00 2001
From: Mariana Dima <mariana@elastic.co>
Date: Fri, 10 Jan 2020 18:56:16 +0100
Subject: [PATCH] Cherry-pick #14666 to 7.5: Restrict permissible regex for
 instance name in perfmon  (#15466)

* Restrict permissible regex for instance name in perfmon  (#14666)

* modify regex

* Added pr id

* refactor unittest

(cherry picked from commit 6280f8386ca0359d9ab0c4a5447cc7497767ee5a)

* Fix changelog
---
 CHANGELOG.next.asciidoc                       |  1 +
 .../windows/perfmon/pdh_query_windows.go      |  2 +-
 .../windows/perfmon/pdh_query_windows_test.go | 25 +++++++++++++++++++
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index c0a662655db..b39e6c0a679 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -67,6 +67,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix checking tagsFilter using length in cloudwatch metricset. {pull}14525[14525]
 - Fixed bug with `elasticsearch/cluster_stats` metricset not recording license expiration date correctly. {issue}14541[14541] {pull}14591[14591]
 - Log bulk failures from bulk API requests to monitoring cluster. {issue}14303[14303] {pull}14356[14356]
+- Fix regular expression to detect instance name in perfmon metricset. {issue}14273[14273] {pull}14666[14666]
 - Fixed bug with `elasticsearch/cluster_stats` metricset not recording license ID in the correct field. {pull}14592[14592]
 - Fix `docker.container.size` fields values {issue}14979[14979] {pull}15224[15224]
 - Make `kibana` module more resilient to Kibana unavailability. {issue}15258[15258] {pull}15270[15270]
diff --git a/metricbeat/module/windows/perfmon/pdh_query_windows.go b/metricbeat/module/windows/perfmon/pdh_query_windows.go
index fc049232451..eef0e727b16 100644
--- a/metricbeat/module/windows/perfmon/pdh_query_windows.go
+++ b/metricbeat/module/windows/perfmon/pdh_query_windows.go
@@ -30,7 +30,7 @@ import (
 )
 
 var (
-	instanceNameRegexp = regexp.MustCompile(`.*\((.*)\).*`)
+	instanceNameRegexp = regexp.MustCompile(`.*?\((.*?)\).*`)
 	objectNameRegexp   = regexp.MustCompile(`(?:^\\\\[^\\]+\\|^\\)([^\\]+)`)
 )
 
diff --git a/metricbeat/module/windows/perfmon/pdh_query_windows_test.go b/metricbeat/module/windows/perfmon/pdh_query_windows_test.go
index 60f2ead32a4..4b5c8710499 100644
--- a/metricbeat/module/windows/perfmon/pdh_query_windows_test.go
+++ b/metricbeat/module/windows/perfmon/pdh_query_windows_test.go
@@ -89,3 +89,28 @@ func TestSuccessfulQuery(t *testing.T) {
 	assert.Nil(t, err)
 	assert.NotNil(t, list)
 }
+
+// TestInstanceNameRegexp tests regular expression for instance.
+func TestInstanceNameRegexp(t *testing.T) {
+	queryPaths := []string{`\SQLServer:Databases(*)\Log File(s) Used Size (KB)`, `\Search Indexer(*)\L0 Indexes (Wordlists)`,
+		`\Search Indexer(*)\L0 Merges (flushes) Now.`, `\NUMA Node Memory(*)\Free & Zero Page List MBytes`}
+	for _, path := range queryPaths {
+		matches := instanceNameRegexp.FindStringSubmatch(path)
+		if assert.Len(t, matches, 2, "regular expression did not return any matches") {
+			assert.Equal(t, matches[1], "*")
+		}
+	}
+}
+
+// TestObjectNameRegexp tests regular expression for object.
+func TestObjectNameRegexp(t *testing.T) {
+	queryPaths := []string{`\Web Service Cache\Output Cache Current Flushed Items`,
+		`\Web Service Cache\Output Cache Total Flushed Items`, `\Web Service Cache\Total Flushed Metadata`,
+		`\Web Service Cache\Kernel: Current URIs Cached`}
+	for _, path := range queryPaths {
+		matches := objectNameRegexp.FindStringSubmatch(path)
+		if assert.Len(t, matches, 2, "regular expression did not return any matches") {
+			assert.Equal(t, matches[1], "Web Service Cache")
+		}
+	}
+}