# How i can work with kibana (Grockl)
**URL:** https://discuss.elastic.co/t/how-i-can-work-with-kibana-grockl/217218
**Category:** Logstash
**Created:** [January 30, 2020, 3:02pm UTC](https://discuss.elastic.co/t/how-i-can-work-with-kibana-grockl/217218 "2020-01-30T15:02:58Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Sergey\_Serov](https://discuss.elastic.co/u/Sergey_Serov)
#### Post date: [January 30, 2020, 3:02pm UTC](https://discuss.elastic.co/t/how-i-can-work-with-kibana-grockl/217218/1 "2020-01-30T15:02:58Z")
I'm not sure what it's called, sort of grok maybe )
Do not judge strictly) today I am the first day with ELK.
I have a problem with fields received from Windows Server.
'Execution ProcessID' = 'ProcessId'
Can someone manual how to do this?
I would be very grateful.
Example from Win out.
- 4689 0 0 13313 0 0x8020000000000000 523834 \<\*\*Execution ProcessID\*\*="4" ThreadID="104" /\> Security sd-193.SD.LOCAL - S-1-5-21-1701381398-1125909616-1447102860-26926 user\_adm DDD 0x473f159 0x0 0x2e80 C:\Windows\System32\notepad.exe
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2020, 3:03pm UTC](https://discuss.elastic.co/t/how-i-can-work-with-kibana-grockl/217218/2 "2020-02-27T15:03:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.