[Metricbeat] Windows perfmon wildcard queries with multiple brackets show wrong instance name

[peterdkdp]

Similar to issue #9835 , but I'm not sure if this should be handled as the same bug.
In the windows/perfmon module, when using a wildcard query with multiple brackets the string between the last brackets is used as instance name.

Module example from metricbeat.yml:

- module: windows
  metricsets: [perfmon]
  period: 1m
  perfmon.ignore_non_existent_counters: true
  perfmon.group_measurements_by_instance: true
  perfmon.counters:
    - instance_label: sqlserver.database.name
      measurement_label: database.log_file_size
      query: '\SQLServer:Databases(*)\Log File(s) Size (KB)'
      format: "long"
    - instance_label: sqlserver.database.name
      measurement_label: database.log_file_used_size
      query: '\SQLServer:Databases(*)\Log File(s) Used Size (KB)'
      format: "long"

Results in the following (example from Kibana discovery):
windows.perfmon.database.log_file_size 73,720
windows.perfmon.database.log_file_used_size 96,447
windows.perfmon.sqlserver.database.name KB

All database.name are "KB"

Elastic & Metricbeat version: 7.3.2

[narph]

@peterdkdp , thanks for bringing this issue up.
It seems that the regular expression that matches the instance name was too permissive and was picking up the KB from the size instead of the instance name inside ...\SQLServer:Databases(instance name).

Potential solution and tests are found in the PR #14666.

This issue is not similar to #9835. The mentioned ticket talks about the added value of adding the counter to the instance name.