Hello using winlogbeat and elasticsearch as the output (not logstash) can i create a key-value pari lookup database? use case: For event_id: 4625 i would like to include fields or do a lookup for the Status and Substatus fields, eg. Is this best achieved with a processor?, such as below or somet…

You could accomplish this with either a series of add_fields processors on the Winlogbeat side or using an Ingest Node pipeline in Elasticsearch. With Ingest Node you would using the script processor to translate status codes.

Discuss the Elastic Stack

Add fields to winlogbeat events

Elastic Stack Beats

ajhstn May 24, 2019, 9:47pm 3

Thank you @andrewkroh could you please give me an example?

Topic		Replies	Views
Create Field Winlogbeat Beats winlogbeat	5	483	June 25, 2020
Parsing winlogbeat message field Beats winlogbeat	3	2080	July 20, 2019
How to add a field with description for a specific Windows Event ID? Beats winlogbeat	6	589	April 28, 2021
Winlogbeat multiple add_fields processors throws an error Beats winlogbeat	2	648	May 26, 2020
Fields.stage is empty Beats winlogbeat	2	723	June 16, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Add fields to winlogbeat events

Related topics