Extract Windows Event Log fields

Elastic Stack Beats
1

Hello.
I need help about extract Windows Event Log fields. For example, In below image, How can I extract "Subject”, “Object” and “Accesses” from “message” ?

Untitled
Untitled.png1330×488 39 KB

I have written below lines but I can't extract "message" parts:

processors:
  - include_fields:
      fields: ["_index", "@timestamp", "beat.name" , "event_data.ObjectName" , "event_data.ObjectType" , "event_data.SubjectUserName", "keywords"]

Thank you.

2

This topic was automatically closed after 21 days. New replies are no longer allowed.