# Logstash can't recognize "message" field from winlogbeat

**URL:** <https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 22, 2017, 4:28pm UTC](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518 "2017-09-22T16:28:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![leonkin](https://avatars.discourse-cdn.com/v4/letter/l/a183cd/32.png) [@leonkin](https://discuss.elastic.co/u/leonkin)\
**Post date:** [September 22, 2017, 4:28pm UTC](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518/1 "2017-09-22T16:28:44Z")

</div>

winlogbeat version 5.6.1  
config winlonbeat.yml

> ```
> winlogbeat:
> registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml
> event_logs:
> - name: Application
> output.logstash:
> # The Logstash hosts
> hosts: ["host:port"]
> 
> ```

config on logstash side

> ```
> input {
> beats {
> port => port
> }}
> output {
> elasticsearch {
> hosts => ["localhost:9200"]
> sniffing => true
> manage_template => false
> index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> document_type => "%{[@metadata][type]}"
> }
>     
> stdout { codec => rubydebug }
> }
> 
> ```

==================winlogbeat output================

> ```
> 2017/09/22 10:58:41.642698 client.go:214: DBG Publish: {
> "@timestamp": "2015-08-09T13:03:01.000Z",
> "beat": {
> "hostname": "hostname",
> "name": "hostname",
> "version": "5.6.1"
> },
> "computer_name": "x.y.z.com",
> "event_data": {
> "Binary": "7B39363345354645422D313336372D343642392D383531442D413935374631413
> 3373437467D303030306337303938643436333465336636326338626663396234646633386137363
> 4653030303030393034",
> "param1": "Microsoft Network Monitor: NetworkMonitor Parsers 3.4",
> "param2": "3.4.2350.0",
> "param3": "1033",
> "param4": "0",
> "param5": "Microsoft Corporation",
> "param6": "(NULL)"
> },
> "event_id": 1035,
> "keywords": [
> "Classic"
> ],
> "level": "Information",
> "log_name": "Application",
> "message": "Windows Installer reconfigured the product. Product Name: Microsof
> t Network Monitor: NetworkMonitor Parsers 3.4. Product Version: 3.4.2350.0. Prod
> uct Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success
> or error status: 0.",
> "opcode": "Info",
> "record_number": "16758",
> "source_name": "MsiInstaller",
> "type": "wineventlog",
> "user": {
> "domain": "NT AUTHORITY",
> "identifier": "S-1-5-18",
> "name": "SYSTEM",
> "type": "Well Known Group"
> }
> 
> ```

==================logstash output==================

> ```
> {
> "computer_name" => "x.y.z.com",
> "message-raw" => "%{logmessage}",
> "syslog_source-IP" => "x.y.z.com",
> "syslog_severity_code" => 5,
> "keywords" => [
> [0] "Classic"
> ],
> "log_name" => "Application",
> "level" => "Information",
> "record_number" => "16659",
> "syslog_facility" => "user-level",
> "syslog_facility_code" => 1,
> "event_data" => {
> "param5" => "Microsoft Corporation",
> "param6" => "(NULL)",
> "Binary" => "7B33383334413930352D354343312D343534442D384341342D4143343439463132373735447D3030303064393930613738353432623338326234313262636639386631666531636235333030303030393034",
> "param3" => "1033",
> "param4" => "0",
> "param1" => "Micros10.0"
> },
> "opcode" => "Info",
> "syslog_severity" => "notice",
> "tags" => [
> [0] "beats_input_codec_plain_applied"
> ],
> "@timestamp" => 2015-08-09T04:03:02.000Z,
> "event_id" => 1035,
> "beat" => {
> "name" => "hostname",
> "hostname" => "hostname",
> "version" => "5.6.1"
> },
> "user" => {
> "name" => "SYSTEM",
> "identifier" => "S-1-5-18",
> "type" => "Well Known Group",
> "domain" => "NT AUTHORITY"
> },
> "source_name" => "MsiInstaller"
> }oft System Center Virtual Machine Manager DHCP Server (x64)",
> "param2" => "3.2.7510.0"
> },
> "opcode" => "Info",
> "syslog_severity" => "notice",
> "tags" => [
> [0] "beats_input_codec_plain_applied"
> ],
> "@timestamp" => 2015-08-09T04:03:02.000Z,
> "event_id" => 1035,
> "beat" => {
> "name" => "hostname",
> "hostname" => "hostname",
> "version" => "5.6.1"
> },
> "user" => {
> "name" => "SYSTEM",
> "identifier" => "S-1-5-18",
> "type" => "Well Known Group",
> "domain" => "NT AUTHORITY"
> },
> "source_name" => "MsiInstaller"
> }
> 
> ```

Any ideas - why that happens?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 22, 2017, 5:36pm UTC](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518/2 "2017-09-22T17:36:07Z")

</div>

> [@leonkin](#):
>
> "message-raw" =\> "%{logmessage}",  
> "syslog\_source-IP" =\> "qeblade26",  
> "syslog\_severity\_code" =\> 5,

Those fields are not added by Winlogbeat or Logstash when using the configuration shown. There must be more going on in your Logstash config. Do you have more than one config file in /etc/logstash/conf.d?

---

<div class="post-metadata">

**Author:** ![leonkin](https://avatars.discourse-cdn.com/v4/letter/l/a183cd/32.png) [@leonkin](https://discuss.elastic.co/u/leonkin)\
**Post date:** [September 22, 2017, 8:38pm UTC](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518/3 "2017-09-22T20:38:54Z")

</div>

you are totally right. there was an old filter which was broken by some new code changes and it was mutating all my new messages.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2017, 8:39pm UTC](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518/4 "2017-10-20T20:39:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.