# Custom information in Winlogbeat events

**URL:** <https://discuss.elastic.co/t/custom-information-in-winlogbeat-events/149955>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 26, 2018, 8:18am UTC](https://discuss.elastic.co/t/custom-information-in-winlogbeat-events/149955 "2018-09-26T08:18:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AliNjie](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@AliNjie](https://discuss.elastic.co/u/AliNjie)\
**Post date:** [September 26, 2018, 8:18am UTC](https://discuss.elastic.co/t/custom-information-in-winlogbeat-events/149955/1 "2018-09-26T08:18:56Z")

</div>

Hi,

Is there any way to include custom hardware information like serial number the events that Winlogbeat sends? By default, I see that the hostname and Winlogbeat version is included by default but I would like to include the serial number of the Windows device that publishes logs so it's stamped in each event.

Any way to achieve this?

Thanks!

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 5, 2018, 10:10am UTC](https://discuss.elastic.co/t/custom-information-in-winlogbeat-events/149955/2 "2018-10-05T10:10:34Z")

</div>

Hi,

Starting with Beats 6.3, you have the `add_host_metadata` processor:

> **[Brewing in Beats: Enrich your events with host metadata
	  	 | Elastic](https://www.elastic.co/blog/brewing-in-beats-enrich-your-events-with-host-metadata)**
>
> Did you know that Beats 6.2 is already available? Try it and let us know what you think. If you are curious to see the Beats in action, check out the Getting Started with Beats webinar. Oper...

  
[https://www.elastic.co/guide/en/beats/filebeat/current/add-host-metadata.html](https://www.elastic.co/guide/en/beats/filebeat/current/add-host-metadata.html)

However, it includes OS information and not hardware / serial number information, so probably not what you need.

The only way that comes to mind is to add `fields` or `tags` with the required information to the configuration. But this has to be done to the `winlogbeat.yml` configuration by yourself, although is possible to automate it when deploying the configuration in multiple servers, if you have the required tools in place.

[https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-general-options.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-general-options.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2018, 10:10am UTC](https://discuss.elastic.co/t/custom-information-in-winlogbeat-events/149955/3 "2018-11-02T10:10:37Z")

</div>

Closed on November 2, 2018, 10:10am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.