Multi-field on CommandLine in Winlogbeat

[mathurin68]

Hey @andrewkroh !!

That would definitely make things easier on me, and that's good to know about the fields.yml!

Thank you so much -

I cleaned it up and sort of re-asked it here, if I could close it I would...

Winlogbeat modified to Text and Keyword

Alright correction, the field doesn't work in the 'Discover', but I can do aggregations in Visualize???? No idea what I did... [image] but the field is empty in 'Discover' -- [image] No idea... but appreciate any suggestions.

I am definitely going to redo this using the fields.yml.