# Parse out window event logs message

**URL:** <https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296>\
**Category:** Logstash\
**Created:** [June 11, 2019, 11:11pm UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296 "2019-06-11T23:11:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![NieruHawic](https://avatars.discourse-cdn.com/v4/letter/n/ec9cab/32.png) [@NieruHawic](https://discuss.elastic.co/u/NieruHawic)\
**Post date:** [June 11, 2019, 11:11pm UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296/1 "2019-06-11T23:11:55Z")

</div>

I would like to take the message section from windows event logs and be able to use the different areas to filter. Right now the message comes across as

"message": "An attempt was made to access an object.\n\nSubject:\n\tSecurity ID:\t\txxxxxxxxxxx\n\tAccount Name:\t\txxxxx\n\tAccount Domain:\t\txxxx\n\tLogon ID:\t\txxxxxx\n\nObject:\n\tObject Server:\tSecurity\n\tObject Type:\tFile\n\tObject Name:\tD:\USERS\xxxxxx\My Pictures\xxxx.jpg\n\tHandle ID:\xxxx\n\nProcess Information:\n\tProcess ID:\txxx\n\tProcess Name:\t\n\nAccess Request Information:\n\tAccesses:\tReadData (or ListDirectory)\n\t\t\t\t\n\tAccess Mask:\t0x1",

I would like to filter the access request information and access part of the message log.  
Can anyone help me out with this.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 12, 2019, 12:39am UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296/2 "2019-06-12T00:39:15Z")

</div>

It can be done. But you need to learn enough "markdown" to show what your message looks like. A simple posting will consume \* (bold) and \_ (newline) as if they as formatting, and \t and \n are not interpreted the way you expect.

---

<div class="post-metadata">

**Author:** ![chitreshg](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@chitreshg](https://discuss.elastic.co/u/chitreshg)\
**Post date:** [June 12, 2019, 12:32pm UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296/3 "2019-06-12T12:32:24Z")

</div>

First remove unnecessary tab from your message, for this you can use gsub

> mutate{  
> gsub =\> ["message", "\t", ""]  
> }

now split the message into key-value pair.

> kv{  
> source =\> "message"  
> value\_split =\> ":"  
> field\_split =\> "\n"  
> }

try the above solution and let me know is it working or not.

---

<div class="post-metadata">

**Author:** ![NieruHawic](https://avatars.discourse-cdn.com/v4/letter/n/ec9cab/32.png) [@NieruHawic](https://discuss.elastic.co/u/NieruHawic)\
**Post date:** [June 12, 2019, 4:49pm UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296/4 "2019-06-12T16:49:57Z")

</div>

That worked. Thanks for the help

---

<div class="post-metadata">

**Author:** ![EZprogramming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ezprogramming/32/57291_2.png) [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\
**Post date:** [June 12, 2019, 5:38pm UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296/5 "2019-06-12T17:38:18Z")

</div>

Choose or post your solution @NieruHawic, Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2019, 5:38pm UTC](https://discuss.elastic.co/t/parse-out-window-event-logs-message/185296/6 "2019-07-10T17:38:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.