# Adding .raw to winlogbeat messages
**URL:** https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159
**Category:** Beats
**Tags:** winlogbeat
**Created:** [August 16, 2016, 3:11pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159 "2016-08-16T15:11:30Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@joshablett](https://discuss.elastic.co/u/joshablett)
#### Post date: [August 16, 2016, 3:11pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/1 "2016-08-16T15:11:30Z")
Hi - I'm using the default winlogbeat.template.json file that downloaded with winlogbeat.
I've made some modifications to the mapping in an attempt to get .raw not-analyzed results to show up for key string fields in Windows Event Viewer, specifically: category and source\_name.
Below is a copy of my template file. The lines I added are rows 31-50. I also:
- Stopped the winlogbeat service on my client
- Deleted my winlogbeat indexes on Elasticsearch
- Deleted .winlogbeat.yml in C:\ProgramData\winlogbeat
- Made the edits below to winlogbeat.template.json
- Restarted the winlogbeat service
- When data started showing up, deleted and recreated the index mapping in Kibana.
What am I doing wrong? .raw are still not showing up in Kibana in either Visualize or Explore.
```auto
{
"mappings": {
"_default_": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": "*"
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"index": "analyzed",
"type": "string"
},
"category": {
"analyzer": "standard",
"fields": {
"raw": {
"index": "not_analyzed",
"type": "string"
}
},
"type": "string"
},
"source_name": {
"analyzer": "standard",
"fields": {
"raw": {
"index": "not_analyzed",
"type": "string"
}
},
"type": "string"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "winlogbeat-*"
}
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 16, 2016, 3:23pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/2 "2016-08-16T15:23:26Z")
Hi @joshablett, first off these modification should not be necessary. The provided index template should be setting the type of these fields to be not\_analyzed strings. What version of Winlogbeat are you using?
I did not see you mention in your steps that you actually installed the index template to Elasticsearch. Before you index any data in Elasticsearch you need to HTTP PUT the index template into ES unless you have configured Winlogbeat to automatically install the template (if you are changing an already installed template then you need also `overwrite: true`). [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html)
You can check that the template is installed with `curl http://localhost:9200/_template/winlogbeat?pretty`.
---
### Author:  [@joshablett](https://discuss.elastic.co/u/joshablett)
#### Post date: [August 16, 2016, 5:55pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/3 "2016-08-16T17:55:51Z")
Hi Andrew - thanks for the reply!
Just to be sure, I deleted, re-downloaded winlogbeat, and did a full reinstall. This wiped away the changes I had previously made to the winlogbeat.template.json file.
I am using version 1.2.3 from this page, downloaded today: [https://www.elastic.co/downloads/beats/winlogbeat](https://www.elastic.co/downloads/beats/winlogbeat)
Here is the template setting from my winlogbeat.yml file:
```
# A template is used to set the mapping in Elasticsearch
# By default template loading is disabled and no template is loaded.
# These settings can be adjusted to load your own template or overwrite existing ones
template:
# Template name. By default the template name is winlogbeat.
#name: "winlogbeat"
# Path to template file
path: "winlogbeat.template.json"
# Overwrite existing template
overwrite: true
```
When I check that the template is installed with curl [http://localhost:9200/\_template/winlogbeat?pretty](http://localhost:9200/_template/winlogbeat?pretty), all I get in response is an empty bracket {}.
Any other things I can check?
Thanks,
Josh
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 16, 2016, 6:08pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/4 "2016-08-16T18:08:50Z")
Can you please post the full config file. I want to make sure that the indentation is correct.
---
### Author:  [@joshablett](https://discuss.elastic.co/u/joshablett)
#### Post date: [August 16, 2016, 6:33pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/5 "2016-08-16T18:33:51Z")
You bet! Here it is:
> **[winlogbeat.yml](https://www.dropbox.com/s/ypwo2yqp76380iy/winlogbeat.yml?dl=0)**
>
> Shared with Dropbox
It was too large to fit, and the file uploader only accepts images.
Thanks!
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 16, 2016, 6:38pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/6 "2016-08-16T18:38:22Z")
Everything appears to correct. Can you try running it with debug turned on to see if there is anything relevant about the template being loaded.
You have to modify the config file. Change `level` from info to debug and set `selectors` to \*. Then restart Winlogbeat.
```auto
level: debug
selectors: ['*']
```
---
### Author:  [@joshablett](https://discuss.elastic.co/u/joshablett)
#### Post date: [August 16, 2016, 6:56pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/7 "2016-08-16T18:56:15Z")
Nope. Searched for "template" and didn't see anything.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 16, 2016, 7:03pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/8 "2016-08-16T19:03:47Z")
There should definitely be some log lines related the template loading coming from v1.2.3. You should be seeing some of the log lines coming from here:
>
>
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 16, 2016, 7:13pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/9 "2016-08-16T19:13:57Z")
Try uncommenting the `#name: "winlogbeat"` line in the template options.
---
### Author:  [@joshablett](https://discuss.elastic.co/u/joshablett)
#### Post date: [August 22, 2016, 3:08pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/10 "2016-08-22T15:08:44Z")
Hi Andrew - sorry for the delay. I've actually updated to the 5.0.0 winlogbeat alpha to get the parsed fields. With a clean install, I'm still not seeing the .raw option. Should I follow the same steps to troubleshoot this version?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 22, 2016, 3:36pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/11 "2016-08-22T15:36:25Z")
There fields are not named as `.raw` but all the strings (with the exception of `message`) are not\_analyzed strings (or keywords in ES 5.x). Here's the [template file](https://github.com/elastic/beats/blob/5.0/winlogbeat/winlogbeat.template-es2x.json) used with ES 2.x.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 12, 2016, 3:37pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159/12 "2016-09-12T15:37:17Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.