Hi, On kibana when I forwarded the logs I don't see like message id or message fields and a parsed fields, I just see this event_data.param. How can I send in the proper format? This is the raw json. Our flow loks like this: Client -> Indexerserver -> elastic search -> kibana Should be the mes…

Event_data.param# instead of the correct fields

andrewkroh (Andrew Kroh) August 31, 2018, 5:01pm 2

Please read my response in Generically named event_data.paramN on Windows XP and 2003. I think it explains what you are seeing.

Topic		Replies	Views
Message filed is missing when Winlogbeat is used Beats winlogbeat	12	2498	October 10, 2017
Winlogbeat 5.1.1 and event_data.param as raw Beats winlogbeat	2	887	February 5, 2017
Event messages are splitted in event_data.param xy? How to fix that? Beats winlogbeat	5	2864	October 28, 2016
Windows event fields parsing Logstash	3	449	July 30, 2019
Split "event_data" to only show the original data field Logstash	3	1582	April 13, 2017