Miss the field winlog.keywords in ForwardedEvents event_logs

Elastic Stack Beats
1

all the security Events have the the field winlog.keywords but ForwardedEvents don't Forward it.

How can i configure the winlogbeat.yml file that the ForwardedEvents fordward the field winlog.keywords ?

https://www.elastic.co/guide/en/beats/winlogbeat/master/exported-fields-winlog.html
winlog.keywords is required: False
How can i make it true?

2

Try to use inlude_fields but it doesn' work

  • name: ForwardedEvents
    processors:
    - include_fields:
    when:
    has_fields: ["winlog.computer_name"]
    fields: ["winlog.keywords"]