Missing event_data fields in Winlogbeat 1.x



winlogbeat 1.3 is installed and successful send event log directly to elastic on port 9200. Index is created in Kibana and I can see fields related to winlogbeat except all the "event_data fields.*" !

(Andrew Kroh) #2

Those fields are not present in Winlogbeat 1.x. That data/feature was added in Winlogbeat 5.x.


Does Winlogbeat 5.x is compatible with Elasticsearch 2.3.x ?
If yes, can I upgrade from Winlogbeat 1.3 to 5.x ?

(Andrew Kroh) #4

Yes, we include an index template that is compatible with ES 2.x.

There are some minor changes in the configuration files. I recommend you see the upgrade guide. There will be some minor config file changes and you will need to install and updated index template.



Thanks again for your great support,

Just to let you know that it's working now.

(system) #6

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.