For normalization purposes, I would like to copy the contents of
user.name if the former is present but the latter is not.
I tried the following, but it does not work:
- copy_fields: when: and: - equals.user.name: "" - not.equals.winlog.user.name: "" fields: - from: winlog.user.name to: user.name fail_on_error: false ignore_missing: true
There are some Windows events where Winlogbeat parses out the username to
winlog.user.name but leaves
user.name blank. For example, event ID 4104 (PowerShell script block logging).
Event ID 4104 is in the
PowerShellCore/Operational log channels. I successfully set up a
copy_fields processor in
winlogbeat.yml for those log channels (see this topic), but it occurred to me that it's just better to check any event that has
winlog.user.name but not
user.name and have it perform the field copy.