Field 'Logon ID' not available

Elastic Stack Kibana
1

Hi everyone,

I'm using Kibana 5.0 for visualizing Windows Event Logs like the following:

Kibana
Kibana.png1697×97 10.9 KB

My Problem is, that there are two Logon ID's and Kibana is using the first one to be a field, but I need the second one for filtering. What can I do? Do I have to change the mapping in ElasticSearch? I'm new to the ELK-Stack. =)

Thanks in advance!

2

Hello,
What are you using to ingest the Windows Event Logs in kibana? There might be a way to filter that ID out in order to have it as a separate field for you.

3

Hello Marius,

we are using Wazuh Agents to collect the data und had to change the decoders. Thank you for your help but the Problem is solved. =)

4

It would be cool if you could share how you fixed the problem, for anybody else that might hit this snag.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.