Copy winlog.user.name (if present) to user.name (if missing)

Elastic Stack Beats
1

For normalization purposes, I would like to copy the contents of winlog.user.name to user.name if the former is present but the latter is not.

I tried the following, but it does not work:

- copy_fields:
    when:
      and:
        - equals.user.name: ""
        - not.equals.winlog.user.name: ""
    fields:
      - from: winlog.user.name
        to: user.name 
    fail_on_error: false
    ignore_missing: true

There are some Windows events where Winlogbeat parses out the username to winlog.user.name but leaves user.name blank. For example, event ID 4104 (PowerShell script block logging).

Event ID 4104 is in the Microsoft-Windows-PowerShell/Operational and PowerShellCore/Operational log channels. I successfully set up a copy_fields processor in winlogbeat.yml for those log channels (see this topic), but it occurred to me that it's just better to check any event that has winlog.user.name but not user.name and have it perform the field copy.

2

hi @_finack, is this the same issue as User.name field for event ID 4104? If not can you clarify?

3

Not quite. The topic you referenced (mine also) was about event ID 4104 specifically. I was able to solve that one by doing the action based on the source log channel.

In this topic, I am searching for a way to copy winlog.user.name to user.name anytime the former exists (and is set to a value) and the latter does not, no matter what event ID or source log channel.

The example processor code in my OP does not work. It does not result in a populated user.name field for events where winlog.user.name is present but user.name isn't.

I'm assuming the issue is how I'm declaring the conditionals or the values for them, but I do not know how to fix it.

4

Try using has_fields as a condition.

1 Like
5

I will look into that. Thank you for the tip!

6

A working solution:

- copy_fields:
    when:
      and:
        - has_fields: ['winlog.user.name']
        - not.has_fields: ['user.name']
      fields:
        - from: winlog.user.name
          to: user.name 
      fail_on_error: false
      ignore_missing: true

Thanks again to @andrewkroh for the tip!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.