# Many many processors, how many is too many?

**URL:** <https://discuss.elastic.co/t/many-many-processors-how-many-is-too-many/194729>\
**Category:** Beats\
**Created:** [August 11, 2019, 3:06am UTC](https://discuss.elastic.co/t/many-many-processors-how-many-is-too-many/194729 "2019-08-11T03:06:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Post date:** [August 11, 2019, 3:06am UTC](https://discuss.elastic.co/t/many-many-processors-how-many-is-too-many/194729/1 "2019-08-11T03:06:28Z")

</div>

I have a very long winlogbeat processor list that does a heap of security related stuff like;

# Add failure code descriptions

```
    - add_fields:
        when.equals.winlog.event_data.Status: "0xc000006a"
        fields:
          winlog.event_data.StatusDescription: "Bad password."
        target: ""
    - add_fields:
        when.equals.winlog.event_data.Status: "0xc000006e"
        fields:
          winlog.event_data.StatusDescription: "Unknown user name or bad password."
        target: ""

```

and

# Add group mod descriptions

```
- add_fields:
    when.equals.winlog.event_id: 4727
    fields:
        winlog.event_data.Info: "A security-enabled global group was created."
    target: ""
- add_fields:
    when.equals.winlog.event_id: 4728
    fields:
        winlog.event_data.Info: "A member was added to a security-enabled global group."
    target: ""
- add_fields:
    when.equals.winlog.event_id: 4729
    fields:
        winlog.event_data.Info: "A member was removed from a security-enabled global group."
    target: ""

```

I have two questions;

1. Is this the most efficient way of doing this- if not can i have examples of other ways (without using Logstash)
2. I'd like to use ECS. To make use of ECS do i simply need to convert or copy the "username" fields to `user.name` using processors or is there a completely different official way to populate the `user.name` field and other ECS fields?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [August 13, 2019, 9:15am UTC](https://discuss.elastic.co/t/many-many-processors-how-many-is-too-many/194729/2 "2019-08-13T09:15:54Z")

</div>

With windows event logs, throughput is normally limited by the Windows APIs itself.

for number of processors it maybe depends on the input configuration as well. Looking at your snipped I assume these are global processors. Each beat support local processors as well. This very often reduces the need for filtering, but also keeps processors close to where the events are generated (eases maintenance if you have a large set of inputs).

> - I'd like to use ECS. To make use of ECS do i simply need to convert or copy the "username" fields to `user.name` using processors or is there a completely different official way to populate the `user.name` field and other ECS fields?

Which username field? Which winlogbeat version are you using? Winlogbeat 7.x+ should use ECS, and if not I'd say it's a bug.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2019, 11:15am UTC](https://discuss.elastic.co/t/many-many-processors-how-many-is-too-many/194729/3 "2019-09-10T11:15:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.