Grok WinEvt log

Elastic Stack Logstash
1

Hello

I was trying to grok for this CSV line that I downloaded from my windows 10 logs, I see that it is separated by commas, but the last value comes lines like this, does anyone have any ideas?

8/26/2020,5:34:23 PM,Security,Success Audit,Object Access ,560,DOMAIN\jose,SERVER,"Object Open:
    Object Server:  Security
    Object Type:    Dir
    Object Name:    \fs03\fs03-fileshare\test$\2020\Agosto\25"

Thanks for support.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.