# Event outcome and winlog.keywords - Possible Bug

**URL:** <https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 23, 2020, 2:17pm UTC](https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353 "2020-07-23T14:17:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\
**Post date:** [July 23, 2020, 2:17pm UTC](https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353/1 "2020-07-23T14:17:57Z")

</div>

Hi,  
I'm using winlogbeat in DC that are in different languages (English and Spanish).  
Looking at the event.outcome I realized that was missing in the events coming from the DC with Spanish set.  
That is because the event.outcome is populated in the security module based in the text coming in the winlog.keywords field and apparently depends on the language .

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/9/093a11c3081650261ed763a25a15e976ed287e61.png)

My question is: how the winlog.keywords events is generated? Because in the raw event we only have the keywords field with

0x8010000000000000 -\> Indicates Failure  
0x8020000000000000 -\> Indicates Success

Should be better to preserve the original values in order not to be language-dependant?  
(and modify the mapping in the security module)

@andrewkroh, what do you think?

Thank you  
Regards  
Ana

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 11, 2020, 8:07pm UTC](https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353/2 "2020-08-11T20:07:29Z")

</div>

I've opened a pull request to fix this at [https://github.com/elastic/beats/pull/20564](https://github.com/elastic/beats/pull/20564).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2020, 10:07pm UTC](https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353/3 "2020-09-08T22:07:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.