# Event Data field not created in Kibana

**URL:** <https://discuss.elastic.co/t/event-data-field-not-created-in-kibana/152681>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 16, 2018, 2:20pm UTC](https://discuss.elastic.co/t/event-data-field-not-created-in-kibana/152681 "2018-10-16T14:20:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sketchy](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@Sketchy](https://discuss.elastic.co/u/Sketchy)\
**Post date:** [October 16, 2018, 2:20pm UTC](https://discuss.elastic.co/t/event-data-field-not-created-in-kibana/152681/1 "2018-10-16T14:20:48Z")

</div>

I am using filesystem auditing and logging event 4656.

Is there a way I can have beats create a field for "Accesses" from the data below? All other fields get created except for Accesses.

I want beats to only pickup logs that have DELETE in the Accesses field.  
Why doesn't a field get automatically created called Accesses in Kibana?

Object:  
Object Server: Security  
Object Type: File  
Object Name: Z:\Test1.txt  
Handle ID: 0xba0  
Resource Attributes: -

Process Information:  
Process ID: 0x4f0  
Process Name: C:\Windows\explorer.exe

Access Request Information:  
Transaction ID: {00000000-0000-0000-0000-000000000000}  
Accesses: DELETE

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/event-data-field-not-created-in-kibana/152681/2 "2018-11-13T14:24:50Z")

</div>

Closed on November 13, 2018, 2:24pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.