# Event ID missing - winlogbeat

**URL:** <https://discuss.elastic.co/t/event-id-missing-winlogbeat/243479>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [August 2, 2020, 8:21pm UTC](https://discuss.elastic.co/t/event-id-missing-winlogbeat/243479 "2020-08-02T20:21:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![edvrfn](https://avatars.discourse-cdn.com/v4/letter/e/4bbf92/32.png) [@edvrfn](https://discuss.elastic.co/u/edvrfn)\
**Post date:** [August 2, 2020, 8:21pm UTC](https://discuss.elastic.co/t/event-id-missing-winlogbeat/243479/1 "2020-08-02T20:21:18Z")

</div>

I am interested in event-id 3 of sysmon and and i am not getting it in elasticsearch. There are other event IDs but not this one.

> Blockquote  
> Network connection detected:  
> RuleName: -  
> UtcTime: 2020-08-02 19:46:15.226  
> ProcessGuid: {9a29744c-028e-5f27-2304-000000001100}  
> ProcessId: 4548  
> Image: C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe  
> User: E-PC\epc  
> Protocol: tcp  
> Initiated: true  
> SourceIsIpv6: false  
> SourceIp: 192.168.254.1  
> SourceHostname: host.docker.internal  
> SourcePort: 4835  
> SourcePortName: -  
> DestinationIsIpv6: false  
> DestinationIp: 23.65.246.253  
> DestinationHostname: [a23-65-246-253.deploy.static.akamaitechnologies.com](http://a23-65-246-253.deploy.static.akamaitechnologies.com)  
> DestinationPort: 443  
> DestinationPortName: https

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2020, 8:21pm UTC](https://discuss.elastic.co/t/event-id-missing-winlogbeat/243479/2 "2020-08-30T20:21:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.