# Extract Windows Event Log fields

**URL:** <https://discuss.elastic.co/t/extract-windows-event-log-fields/99185>\
**Category:** Beats\
**Created:** [September 2, 2017, 6:49am UTC](https://discuss.elastic.co/t/extract-windows-event-log-fields/99185 "2017-09-02T06:49:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\
**Post date:** [September 2, 2017, 6:49am UTC](https://discuss.elastic.co/t/extract-windows-event-log-fields/99185/1 "2017-09-02T06:49:52Z")

</div>

Hello.  
I need help about extract Windows Event Log fields. For example, In below image, How can I extract "Subject”, “Object” and “Accesses” from “message” ?

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c8c674f5c3ec60519d5ec753f46c5d459359fb1.png)

I have written below lines but I can't extract "message" parts:

```auto
processors:
  - include_fields:
      fields: ["_index", "@timestamp", "beat.name" , "event_data.ObjectName" , "event_data.ObjectType" , "event_data.SubjectUserName", "keywords"]
```

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2017, 6:49am UTC](https://discuss.elastic.co/t/extract-windows-event-log-fields/99185/2 "2017-09-23T06:49:59Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.