# Mapping Winlogbeat old version to newest ECS

**URL:** <https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625>\
**Category:** Beats\
**Tags:** ecs-elastic-common-schema, winlogbeat\
**Created:** [May 11, 2021, 3:08am UTC](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625 "2021-05-11T03:08:51Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\
**Post date:** [May 17, 2021, 7:32pm UTC](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625/3 "2021-05-17T19:32:34Z")

</div>

I believe you're correct, and using Logstash to rename the fields would be the workaround.

Another item to be aware of - when working with Windows Server 2003, you'll likely run into the log message parameters not being named. There's a detailed explanation from a past discussion [here](https://discuss.elastic.co/t/generically-named-event-data-paramn-on-windows-xp-and-2003/46329/2).

---

_[View the full topic](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625)._