WMI filter

A WMI filter that adds the results from a WMI query to the current event. An optional target destination may be specified. If omitted, the fields will be added to the root event.

This filter is useful for performing join operations between different WMI "tables".

For example, suppose we want to create an event that displays the command line arguments of some process (WIN32_Process) and show the memory consumption of that process (Win32_PerfFormattedData_PerfProc_Process). 

This data resides in the two mentioned WMI tables, with the ProcessId (or IDProcess) being the primary key of those tables. 

Using such a filter we can do the following:

input
{
	wmi
	{
		query => "Select processid, name, commandline From Win32_Process  where name = 'w3wp.exe'  "
		interval => 1
		type => "perfmem"
	}
}

filter
{
	wmi
	{
		query => "Select privatebytes, workingsetprivate, threadcount From Win32_PerfFormattedData_PerfProc_Process where IDProcess = %{ProcessId}"
	}

	mutate
	{
		convert =>
		[
			"privatebytes", "integer",
         		"workingsetprivate", "integer"
		]
	}
}

output
{
	stdout { codec => "rubydebug" }
}