# Monitor Windows Logons win Winlogbeat **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 27, 2020, 11:42pm UTC](https://discuss.elastic.co/t/monitor-windows-logons-win-winlogbeat/234634 "2020-05-27T23:42:06Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Ayesha](https://avatars.discourse-cdn.com/v4/letter/a/c0e974/32.png) [@Ayesha](https://discuss.elastic.co/u/Ayesha)\ **Post date:** [May 27, 2020, 11:42pm UTC](https://discuss.elastic.co/t/monitor-windows-logons-win-winlogbeat/234634/1 "2020-05-27T23:42:06Z")
Hi, I am shipping logs from my DC to Logstash and then to Elasticsearch. I am trying to visualize domain user logins to all domain joined servers. But It is not showing me the name of server on which user logs in. It always shows DC server because that is where authentication is being done. But I am interested to see which user logs on to which server. Has anyone done anything similar before? Regards, Ayesha ---
**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Post date:** [May 28, 2020, 5:20am UTC](https://discuss.elastic.co/t/monitor-windows-logons-win-winlogbeat/234634/2 "2020-05-28T05:20:54Z")
We are using a winlogbeat (6.8.1) to get failed login attempts from our DCs and in this event type there is a field event\_data.IpAddress which is the ip of the host from which the login originates. But i can't gurantee that the same field exists in the normal login event. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 25, 2020, 5:20am UTC](https://discuss.elastic.co/t/monitor-windows-logons-win-winlogbeat/234634/3 "2020-06-25T05:20:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.