For normalization purposes, I would like to copy the contents of winlog.user.name to user.name if the former is present but the latter is not. I tried the following, but it does not work: - copy_fields: when: and: - equals.user.name: "" - not.equals.winlog.user.name: "" …

[image] andrewkroh: Try using has_fields as a condition. A working solution: - copy_fields: when: and: - has_fields: ['winlog.user.name'] - not.has_fields: ['user.name'] fields: - from: winlog.user.name to: user.name fail_on_error: fal…

Copy winlog.user.name (if present) to user.name (if missing)

Elastic Stack Beats

MarianaD (MarianaD) April 23, 2020, 10:33am 2

hi @_finack, is this the same issue as User.name field for event ID 4104? If not can you clarify?

Topic		Replies	Views
Winlogbeat user.name is missing in event 4634 (Logoff Event) - ECS Missing Correlation Beats winlogbeat	11	1541	September 3, 2019
User.name field for event ID 4104 Beats winlogbeat	2	2321	May 20, 2020
Winlogbeat Alert for certain users in Windows PC Beats winlogbeat	5	471	February 14, 2023
Help with Winlogbeat yaml config Beats	7	558	December 30, 2019
Winlogbeat filtering problem Beats winlogbeat	3	337	October 12, 2020

Copy winlog.user.name (if present) to user.name (if missing)

Related topics