# Copy winlog.user.name (if present) to user.name (if missing)

**URL:** <https://discuss.elastic.co/t/copy-winlog-user-name-if-present-to-user-name-if-missing/229313>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 22, 2020, 4:30pm UTC](https://discuss.elastic.co/t/copy-winlog-user-name-if-present-to-user-name-if-missing/229313 "2020-04-22T16:30:08Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [April 23, 2020, 10:33am UTC](https://discuss.elastic.co/t/copy-winlog-user-name-if-present-to-user-name-if-missing/229313/2 "2020-04-23T10:33:30Z")

</div>

hi @_finack, is this the same issue as [User.name field for event ID 4104](https://discuss.elastic.co/t/user-name-field-for-event-id-4104/229296)? If not can you clarify?

---

_[View the full topic](https://discuss.elastic.co/t/copy-winlog-user-name-if-present-to-user-name-if-missing/229313)._