# Custom event parsing **URL:** \ **Category:** Elasticsearch\ **Created:** [November 30, 2021, 3:35pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568 "2021-11-30T15:35:31Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![ohliuw](https://avatars.discourse-cdn.com/v4/letter/o/a9adbd/32.png) [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Post date:** [November 30, 2021, 3:35pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/1 "2021-11-30T15:35:31Z")
I am relatively new to SO. I am trying to understand how to ingest and parse customs logs in ELS. I currently use the NXLog agent to send json formatted data (coming from the SYSMON windows eventlog) from a host to the logstash port (5044) on the manager. As per the manual, it's now ELS that does the ingestion, correct? However it is not clear to me what has to happen next? I tried to modify the existing sysmon pipeline without any luck. First, it is not clear how ELS decides which parser to use when it receives the raw event from logstash? Then, after the data is parsed, where does it get send? Thank for clearing out my confusion Here is an example of what I trying to ingest: ```auto {"EventTime": "2021-11-30T00:12:12.899263-05:00","Hostname":"MYSERVER","Keywords":"9223372036854775808","EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"TaskValue":11,"OpcodeValue":0,"RecordNumber":6682123,"ExecutionProcessID":9080,"ExecutionThreadID":13784,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: -\r\nUtcTime: 2021-11-30 05:12:12.899\r\nProcessGuid: {CA401AF7-1F55-6184-4700-000000009600}\r\nProcessId: 4148\r\nImage: C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe\r\nTargetFilename: C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\Monitoring Host Temporary Files 8\\1470202\\Microsoft.Windows.Server.DNS.WINS.Discovery.vbs\r\nCreationUtcTime: 2021-11-30 05:12:12.899\r\nUser: NT AUTHORITY\\SYSTEM","Category":"File created (rule: FileCreate)","RuleName":"-","UtcTime":"2021-11-30 05:12:12.899","ProcessGuid":"{CA401AF7-1F55-6184-4700-000000009600}","ProcessId":"4148","Image":"C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe","TargetFilename":"C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\Monitoring Host Temporary Files 8\\1470202\\Microsoft.Windows.Server.DNS.WINS.Discovery.vbs","CreationUtcTime":"2021-11-30 05:12:12.899","User":"NT AUTHORITY\\SYSTEM","EventReceivedTime":"2021-11-30T00:12:14.821147-05:00","SourceModuleName":"sysmon_event","SourceModuleType":"im_msvistalog"} ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 30, 2021, 8:35pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/2 "2021-11-30T20:35:31Z")
Welcome to our community! 😃 What is SO? What manual are you referring to? ---
**Author:** ![ohliuw](https://avatars.discourse-cdn.com/v4/letter/o/a9adbd/32.png) [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Post date:** [November 30, 2021, 9:44pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/3 "2021-11-30T21:44:00Z")
SO - Security Onion Manuals: [https://docs.securityonion.net/en/2.3/elasticsearch.html](https://docs.securityonion.net/en/2.3/elasticsearch.html) > **[Ingest pipelines | Elasticsearch Guide \[7.15\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)** thanks 🙂 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 30, 2021, 9:45pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/4 "2021-11-30T21:45:47Z")
Ahh ok, you might need to hit up the security onion community there, as they have a bunch of customisations that you are using we aren't directly familiar with sorry. Otherwise, someone with relevant experience might stop by! ---
**Author:** ![ohliuw](https://avatars.discourse-cdn.com/v4/letter/o/a9adbd/32.png) [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Post date:** [December 1, 2021, 12:41pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/5 "2021-12-01T12:41:19Z")
Thanks, let me try to simplify my question. How does Elasticsearch decides which pipeline(parser) to apply to an an incoming event? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 1, 2021, 9:02pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/6 "2021-12-01T21:02:06Z")
When a request is passed to Elasticsearch it would usually contain the pipeline that is needed to run - [Ingest pipelines | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/ingest.html#add-pipeline-to-indexing-request) ---
**Author:** ![ohliuw](https://avatars.discourse-cdn.com/v4/letter/o/a9adbd/32.png) [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Post date:** [December 1, 2021, 9:50pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/7 "2021-12-01T21:50:38Z")
What if I send the events on port 514 directly to Elastic? Will it use the default pipeline? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 1, 2021, 9:52pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/8 "2021-12-01T21:52:04Z")
Yes, it may use whatever default pipeline has been defined. But, again, that needs to be set. Elasticsearch doesn't just pick one as default by itself. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 29, 2021, 9:52pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568/9 "2021-12-29T21:52:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.