# Message filed is missing when Winlogbeat is used **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [September 11, 2017, 6:44pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115 "2017-09-11T18:44:00Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [September 11, 2017, 6:44pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/1 "2017-09-11T18:44:00Z")
Hi, I am using Winlogbeat to collect Windows event logs and sending output to Logstash. But the problem is that I am missing message filed and instead I am seeing event\_data filed. And inside event\_data field there is another field named param1. Also I can see the multiple events with the same record\_number. Can someone please explain what it means? Thanks ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 11, 2017, 7:00pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/2 "2017-09-11T19:00:43Z")
If you could give examples of what you are seeing (copy the JSON out of Kibana for the each example event) that would be helpful towards us providing an explanation. > [@amruth](#): > > But the problem is that I am missing message filed and instead I am seeing event\_data filed. If `message` is missing then there is probably a [`message_error`](https://www.elastic.co/guide/en/beats/winlogbeat/current/exported-fields-eventlog.html#_message_error) field saying why. > [@amruth](#): > > And inside event\_data field there is another field named param1. `event_data` contains the raw data written by the Application that created the event. `param1` is the first parameter logged in the event by the Application. Some apps use positional paramters rather than named parameters so you end up with param1, param2, ..., paramN. See [Legacy Winlogbeat alias fields | Winlogbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/exported-fields-eventlog.html#_event_data) > [@amruth](#): > > Also I can see the multiple events with the same record\_number. Each event log has its own record\_number counter. So an event from the Application log can have the same record\_number as an event from the Security log. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [September 11, 2017, 8:24pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/3 "2017-09-11T20:24:32Z")
> [@andrewkroh](#): > > If you could give examples of what you are seeing (copy the JSON out of Kibana for the each example event) that would be helpful towards us providing an explanation. First example:(copied from logstash output) ``` { "computer_name" => "mycomputer", "level" => "Error", "log_name" => "Application", "record_number" => "142921", "event_data" => { "param1" => "2017-08-16 23:07:18.911 -0400 catalina-exec-478 ERROR: com.software.controller.dataserver.DataServerSessi onService - Error response. code:401 type:DataServerNoAuth msg:No Server user found." }, "type" => "wineventlog", "tags" => [ [0] "beats_input_raw_event" ], "event_id" => 4096, "@timestamp" => 2017-08-17T03:07:18.000Z, "beat" => { "hostname" => "mycomputer", "name" => "mycomputer", "version" => "5.5.0" }, "@version" => "1", "host" => "mycomputer", "source_name" => "Server (Dataserver)" } ``` Second Example:(copied from logstash output) ``` { "computer_name" => "mycomputer", "keywords" => [ [0] "Classic" ], "level" => "Error", "log_name" => "Application", "record_number" => "158968", "event_data" => { "param1" => "hr=0x80072EE2", "param2" => "00010001(0x00000000, 04:07:55:564 error at line 4" }, "message" => "License acquisition failure", "type" => "wineventlog", "tags" => [ [0] "beats_input_codec_plain_applied" ], "@timestamp" => 2017-09-10T08:08:16.000Z, "event_id" => 8200, "provider_guid" => "{C8C9-472C-A5F9-F2BDFEA0F156}", "@version" => "1", "beat" => { "hostname" => "mycomputer", "name" => "mycomputer", "version" => "5.5.0" }, "host" => "mycomputer", "source_name" => "Microsoft-Windows-Security-SPP" } ``` > [@andrewkroh](#): > > If message is missing then there is probably a message\_error field saying why. I don't see any error ☹ > [@andrewkroh](#): > > event\_data contains the raw data written by the Application that created the event. param1 is the first parameter logged in the event by the Application. Some apps use positional paramters rather than named parameters so you end up with param1, param2, ..., paramN. See [Legacy Winlogbeat alias fields | Winlogbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/exported-fields-eventlog.html#_event_data) Is there any way where I can combine all the param fields into a single field? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 11, 2017, 10:02pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/4 "2017-09-11T22:02:51Z")
The second example event looks normal (it has a `message`). That first one is missing the `message` so I'm wondering what shows up in the Windows Event Viewer for this message? Also could you add [`include_xml: true`](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_event_logs_include_xml) to the config for the Application log. This should show what information Windows is providing to Winlogbeat for that event. There will be an additional field called `xml` in each event from the Application log. Can you please share an event where it's missing `message` and has `xml`. ```auto winlogbeat.event_logs: - name: Application include_xml: true ``` > [@amruth](#): > > Is there any way where I can combine all the param fields into a single field? That's typically what the `message` field does, but does it based on a template like `User [param1] logged in at [param2].` With Logstash you should be able to concatenate the fields as you wish. I'd probably try writing a [ruby filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html) to iterate over each `event_data` field and join the values. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [September 12, 2017, 11:02am UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/5 "2017-09-12T11:02:29Z")
> [@andrewkroh](#): > > That first one is missing the message so I'm wondering what shows up in the Windows Event Viewer for this message? ``` - - 4096 2 5 0x80000000000 142902 Application mycomputer - 2017-08-16 23:07:18.693 -0400 catalina-exec-478 ERROR WZUIZqwYJFMAAIAkfo4AAAOe: com.software.controller.dataserver.DataServerSessionService - Error response. code:401 type:DataServerNoAuth msg:No Server user found. ``` > [@andrewkroh](#): > > Also could you add include\_xml: true to the config for the Application log. This should show what information Windows is providing to Winlogbeat for that event. There will be an additional field called xml in each event from the Application log. Can you please share an event where it's missing message and has xml I have added include\_xml: true to the config. I don't see any new logs now. How to make winlogbeat read the older logs? > [@andrewkroh](#): > > That's typically what the message field does, but does it based on a template like User [param1] logged in at [param2]. In my case, message field is entirely different from what param1 and param2 have. Is it acceptable? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 12, 2017, 11:21am UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/6 "2017-09-12T11:21:37Z")
> [@amruth](#): > > How to make winlogbeat read the older logs? There's a file in `C:\ProgramData\winlogbeat\.winlogbeat.yml` that tells Winlogbeat where to resume from. You can delete that file and it will start from the beginning. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [September 12, 2017, 1:55pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/7 "2017-09-12T13:55:54Z")
> [@amruth](#): > > Also could you add include\_xml: true to the config for the Application log. This should show what information Windows is providing to Winlogbeat for that event. There will be an additional field called xml in each event from the Application log. Can you please share an event where it's missing message and has xml ``` { "computer_name" => "mycomputer", "log_name" => "Application", "level" => "Error", "record_number" => "140750", "event_data" => { "param1" => "2017-08-16 23:06:48.036 -0400 catalina-exec-476 ERROR WZU ISKwYJFMAAIAkbZkAAAOU: com.software.controller.dataserver.DataServerSessi onService - Error response. code:401 type:DataServerNoAuth msg:No Server user found." }, "type" => "wineventlog", "tags" => [ [0] "beats_input_raw_event" ], "@timestamp" => 2017-08-17T03:06:48.000Z, "event_id" => 4096, "xml" => "4096250x8000000000000 0140750Applicationmycomputer2017-08-16 2 3:06:48.036 -0400 catalina-exec-476 ERROR WZUISKwYJFMAAIAkbZkAAAOU: com.software.controller.dataserver.DataServerSessionService - Error response. code: 401 type:DataServerNoAuth msg:No Server user found.\r\n", "beat" => { "hostname" => "mycomputer", "name" => "mycomputer", "version" => "5.5.0" }, "@version" => "1", "host" => "mycomputer", "source_name" => "Server (Dataserver)" } ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 12, 2017, 2:20pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/8 "2017-09-12T14:20:48Z")
Thanks for posting the XML as seen from Winlogbeat. Based on that information it is the application, "Server (Dataserver), that does not include a `message`. Is this event from Tableau? I saw this for 4096: [https://community.spiceworks.com/windows\_event/show/19885-tableau-server-dataserver-4096](https://community.spiceworks.com/windows_event/show/19885-tableau-server-dataserver-4096) ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [September 12, 2017, 3:31pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/9 "2017-09-12T15:31:11Z")
Hi Andrew, Yes this a tableau event. For security reasons I didn't include the complete error details. So, Server itself is dropping the message field. Is it acceptable? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 12, 2017, 4:04pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/10 "2017-09-12T16:04:55Z")
I wouldn't say it's dropping the message, but more like the software authors didn't include it when they wrote logging for that event. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [September 12, 2017, 5:22pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/11 "2017-09-12T17:22:51Z")
Makes sense. May be the two events that I posted earlier could be of two different kinds(one had message field and the other didn't). ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 12, 2017, 10:24pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/12 "2017-09-12T22:24:14Z")
Yes, the two events you posted previously were from separate sources. One was from "Server (Dataserver)" (Tableau) and the other from "Microsoft-Windows-Security-SPP". The source\_name identifies the "thing" that logged the event. See our [field docs](https://www.elastic.co/guide/en/beats/winlogbeat/current/exported-fields-eventlog.html) for definitions of each field. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 10, 2017, 10:24pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115/13 "2017-10-10T22:24:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.