# Event.module Field Not Added by Winlogbeat Module (\>= v8.0.0)
**URL:** https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595
**Category:** Beats
**Tags:** beats-module, winlogbeat
**Created:** [April 18, 2022, 7:12am UTC](https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595 "2022-04-18T07:12:20Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@inf](https://discuss.elastic.co/u/inf)
#### Post date: [April 18, 2022, 7:12am UTC](https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595/1 "2022-04-18T07:12:20Z")
Hi there,
As far as I understand, `event.module` is not being added to each document originating from Winlogbeat (starting from v8.0.0) that uses Winlogbeat modules.
This field was previously seen from v7.4.0 onwards, where the field was added in the Winlogbeat module's JavaScript file. Winlogbeat modules changed from 8.0.0 onwards to use Elasticsearch Ingest Node for processing.
In the `winlogbeat-[beats_version]-[module_name]` ingest pipeline, `event.module` is not seen to be added. Here is a snippet of the ingest pipeline, where all parts of the pipeline that handles the `event.X` field is seen (we do not see `event.module`):
I do not see it being added in the `winlogbeat-[beats_version]-routing` ingest pipeline too.
Here is a snippet of a Winlogbeat document (after it had been parsed by the Sysmon ingest pipeline):
References:
1. [Update sysmon and security modules by andrewkroh · Pull Request #13047 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/13047/files)
2. [Beats version 7.4.0 | Beats Platform Reference [8.1] | Elastic](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-7.4.0.html)
3. [Modules | Winlogbeat Reference [8.1] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-modules.html)
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 18, 2022, 10:50pm UTC](https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595/2 "2022-04-18T22:50:47Z")
Thanks for reporting the problem. I've created an issue for this at [[Winlogbeat] 8.x Module pipelines not setting event.module · Issue #31330 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/31330).
---
### Author:  [@inf](https://discuss.elastic.co/u/inf)
#### Post date: [April 19, 2022, 12:29am UTC](https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595/3 "2022-04-19T00:29:44Z")
Thank you for the very prompt reply and for creating an issue about it!
---
### Author:  [@inf](https://discuss.elastic.co/u/inf)
#### Post date: [April 20, 2022, 7:27am UTC](https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595/4 "2022-04-20T07:27:43Z")
Appreciate that the issue has been resolved (very quickly) with this [merged pull request](https://github.com/elastic/beats/pull/31331).
I noted that the change will be backported to earlier v8.x versions - when/how do we install a version of Beats with this latest change? Do we have to wait for the next incremental release of Beats? (i.e. 8.1.3 or 8.2?)
Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2022, 9:27am UTC](https://discuss.elastic.co/t/event-module-field-not-added-by-winlogbeat-module-v8-0-0/302595/5 "2022-05-18T09:27:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.