# Custom Eventlog Parsing **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [August 15, 2016, 8:27am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009 "2016-08-15T08:27:34Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 15, 2016, 8:27am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009/1 "2016-08-15T08:27:34Z")
Hi I am trying to parse a custom windows Event log in to elasticsearch. This eventlog is generated from a powershell script Event Data: `event\_data.param1 RunDate : 15/08/2016 08:29:58 Caller : Services.local/HostedCompanies/xxxxxx/lukaszk00000 ObjectModified : Services.local/HostedCompanies/xxxxxx/lukaszk00000 CmdletName : Set-MailboxMessageConfiguration CmdletParameters : SignatureHtml,AutoAddSignature,Identity ModifiedProperties : Succeeded : True Error : None ` Powershell Script: $SourceName = "ExchangeAdminAudit" $loglevel = "Information" $EventID = "1" $logs = Search-AdminAuditLog -StartDate (get-date).Addminutes(-62) | Select-Object RunDate,Caller,ObjectModified,CmdletName,@{Name=’CmdletParameters’;Expression={[string]::join(",", ($_.CmdletParameters))}},@{Name=’ModifiedProperties’;Expression={[string]::join(";", ($_.ModifiedProperties))}},Succeeded,Error $logs.count foreach ($log in $logs) { #Write-EventLog –LogName Application –Source $SourceName –EntryType $loglevel –EventID $EventID –Message $log Write-EventLog –LogName Application –Source $SourceName –EntryType $loglevel –EventID $EventID –Message ($log | Format-List | Out-String) } Grok (this works ion the herokuapp site) RunDate : %{DATE:date} %{TIME:time} Caller : %{GREEDYDATA:caller} ObjectModified : %{GREEDYDATA:objectmodified} CmdletName : %{GREEDYDATA:cmdletname} CmdletParameters : %{GREEDYDATA:cmdletparameters} ModifiedProperties : %{GREEDYDATA:modifiedproperties}Succeeded : %{GREEDYDATA:succeeded} Error : %{GREEDYDATA:error} But I am unable to get the event data parsed as expected and out put the required fileds. Any idea's ? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 15, 2016, 8:44am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009/2 "2016-08-15T08:44:50Z")
I suggest you edit your post and move it to the Logstash category to make sure it's read by the right people. What do the messages look like in Logstash? Please show the result of a `stdout { codec => rubydebug }` output. ---
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 16, 2016, 8:42am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009/3 "2016-08-16T08:42:59Z")
Hi Sorry, it has taken me this long to get back (and thanks for your help so far) I have added the following to my ouput `if [source_name] == "ExchangeAdminAudit" { stdout { codec => rubydebug } }` This results in the following `{ "message" => "\n\nRunDate : 16/08/2016 06:47:36\nCaller : Services.local/Services.local/Backend/Users/Admin/Rhys Evans - Admin\nObjectModified : Mailstore08\nCmdletName : Move-ActiveMailboxDatabase\nCmdletParameters : ActivateOnServer,Identity\nModifiedProperties : AdminDisplayVersion\nSucceeded : True\nError : None", "@version" => "1", "@timestamp" => "2016-08-16T08:36:34.000Z", "event_data" => { "param1" => "\n\nRunDate : 16/08/2016 06:47:36\nCaller : Services.local/Services.local/Backend/Users/Admin/Rhys Evans - Admin\nObjectModified : Mailstore08\nCmdletName : Move-ActiveMailboxDatabase\nCmdletParameters : ActivateOnServer,Identity\nModifiedProperties : AdminDisplayVersion\nSucceeded : True\nError : None" }, "log_name" => "Application", "source_name" => "ExchangeAdminAudit", "record_number" => "750345", "event_id" => 1, "level" => "Information", "keywords" => [[0] "Classic" ], "type" => "wineventlog", "computer_name" => "S-PANELBE01.Services.local", "opcode" => "Info", "beat" => { "name" => "S-PANELBE01", "hostname" => "S-PANELBE01" }, "tags" => [[0] "services.local", [1] "beats", [2] "beats_input_codec_plain_applied", [3] "_grokparsefailure" ], "host" => "S-PANELBE01" }` I will look at how to move to the logstash forum Thanks ---
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 16, 2016, 8:58am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009/4 "2016-08-16T08:58:29Z")
Hi As an FYI I have managed to work around this for my purposes. Script now looks like `$SourceName = "ExchangeAdminAudit" $loglevel = "Information" $EventID = "1" $logs = Search-AdminAuditLog -StartDate (get-date).Addminutes(-62) | Select-Object RunDate,Caller,ObjectModified,CmdletName,@{Name=’CmdletParameters’;Expression={[string]::join(",", ($_.CmdletParameters))}},@{Name=’ModifiedProperties’;Expression={[string]::join(";", ($_.ModifiedProperties))}},Succeeded,Error $logs.count foreach ($log in $logs) { #Write-EventLog –LogName Application –Source $SourceName –EntryType $loglevel –EventID $EventID –Message $log Write-EventLog –LogName Application –Source $SourceName –EntryType $loglevel –EventID $EventID –Message ($log) }` and grok now looks like `\{RunDate=%{DATE:date} %{TIME:time}; Caller=%{GREEDYDATA:caller}; ObjectModified=%{GREEDYDATA:objectmodified}; CmdletName=%{GREEDYDATA:cmdletname}; CmdletParameters=%{GREEDYDATA:cmdletparameters}; ModifiedProperties=%{GREEDYDATA:modifiedproperties}; Succeeded=%{GREEDYDATA:succeeded}; Error=%{GREEDYDATA:error}\}` Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 6, 2016, 8:58am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009/5 "2016-09-06T08:58:33Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.