Parse out window event logs message

[NieruHawic (Russell)]

I would like to take the message section from windows event logs and be able to use the different areas to filter. Right now the message comes across as

"message": "An attempt was made to access an object.\n\nSubject:\n\tSecurity ID:\t\txxxxxxxxxxx\n\tAccount Name:\t\txxxxx\n\tAccount Domain:\t\txxxx\n\tLogon ID:\t\txxxxxx\n\nObject:\n\tObject Server:\tSecurity\n\tObject Type:\tFile\n\tObject Name:\tD:\USERS\xxxxxx\My Pictures\xxxx.jpg\n\tHandle ID:\xxxx\n\nProcess Information:\n\tProcess ID:\txxx\n\tProcess Name:\t\n\nAccess Request Information:\n\tAccesses:\tReadData (or ListDirectory)\n\t\t\t\t\n\tAccess Mask:\t0x1",

I would like to filter the access request information and access part of the message log.
Can anyone help me out with this.

[Badger]

It can be done. But you need to learn enough "markdown" to show what your message looks like. A simple posting will consume * (bold) and _ (newline) as if they as formatting, and \t and \n are not interpreted the way you expect.

[chitreshg (Chitresh Gargwanshi)]

First remove unnecessary tab from your message, for this you can use gsub

mutate{
gsub => ["message", "\t", ""]
}

now split the message into key-value pair.

kv{
source => "message"
value_split => ":"
field_split => "\n"
}

try the above solution and let me know is it working or not.

[NieruHawic (Russell)]

That worked. Thanks for the help

[EZprogramming (Kourosh Azizi)]

Choose or post your solution @NieruHawic, Thanks!