# Numeric Level Value in Event Logs

**URL:** <https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 21, 2018, 10:24am UTC](https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808 "2018-02-21T10:24:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![froto](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@froto](https://discuss.elastic.co/u/froto)\
**Post date:** [February 21, 2018, 10:24am UTC](https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808/1 "2018-02-21T10:24:39Z")

</div>

Hi There!

I have a question about WinlogBeat. Is there any way to display the "level" field in the EventLog as a numeric value? When I search for the data in Elasticsearch the value of the level field is always displayed write out.

 ![2018-02-21%2011_22_47-Ereignisanzeige](https://us1.discourse-cdn.com/elastic/original/3X/7/9/79faf9298b72ef3d030c6d943253d5d17de2cc16.png)

Is there any way to display the original value of the level field? Like in this example "4".

Regards.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 21, 2018, 4:11pm UTC](https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808/2 "2018-02-21T16:11:33Z")

</div>

No, this isn't configurable. Winlogbeat always reports the rendered level string. And even if it can't get a rendered string it has a fallback to map the number to the names a specified in this [table](https://msdn.microsoft.com/en-us/library/windows/desktop/aa382793(v=vs.85).aspx).

You could use Logstash to [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) the values to numbers. It may not work for all level values if some app creates their own.

```auto
filter {
  translate {
    field => "Level",
    destination => "LevelRaw",
    dictionary => [ "Critical", 1,
                    "Error", 2,
                    "Warning", 3,
                    "Verbose", 4 ]
  }
}

```

Or you could send the [raw XML](https://www.elastic.co/guide/en/beats/winlogbeat/6.2/configuration-winlogbeat-options.html#_literal_event_logs_include_xml_literal) to Logstash to grok the `<LevelRaw>1</LevelRaw>` value. I'm guessing this will be kind of expensive, but for low event volumes it's probably fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 4:11pm UTC](https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808/3 "2018-03-21T16:11:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.