# Parsing Pulling data from EventHub

**URL:** <https://discuss.elastic.co/t/parsing-pulling-data-from-eventhub/213814>\
**Category:** Logstash\
**Created:** [January 5, 2020, 5:15pm UTC](https://discuss.elastic.co/t/parsing-pulling-data-from-eventhub/213814 "2020-01-05T17:15:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![omrip](https://avatars.discourse-cdn.com/v4/letter/o/a9adbd/32.png) [@omrip](https://discuss.elastic.co/u/omrip)\
**Post date:** [January 5, 2020, 5:15pm UTC](https://discuss.elastic.co/t/parsing-pulling-data-from-eventhub/213814/1 "2020-01-05T17:15:09Z")

</div>

when pulling data from event hub the data is all mixed up  
is there a built parser for the events?  
can i have some assistance with parsing the events?

0981Z", "userDisplayName": "bb king", "userPrincipalName": "[bb@king.onmicrosoft.com](mailto:bb@king.onmicrosoft.com)", "userId": "eed0dfdc-0d5d-48bf-8acb-274abf6f2f4c",  
"appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "1.2.3.4", "clientAppUsed":  
"Other clients; Older Office clients", "correlationId": "d9ea8053-2a71-4190-9da2-ed8d7b2047a2", "conditionalAccessStatus": "notApplied", "originalRequestI  
d": "9b7bf234-0320-46b7-9a6c-1113e1830c00", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "processingTimeInMillis  
econds": 65, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTy  
pes": , "resourceDisplayName": null, "resourceId": null, "authenticationMethodsUsed": , "alternateSignInName": "bb@king.onmicros  
[oft.com](http://oft.com)", "servicePrincipalName": null, "servicePrincipalId": "", "mfaDetail": null, "status": { "errorCode": 50057, "fa  
ilureReason": "User account is disabled. The account has been disabled by an administrator.", "additionalDetails": null }, "deviceDetail": { "  
deviceId": "", "displayName": null, "operatingSystem": null, "browser": null, "isCompliant": null, "isManaged": null,  
"trustType": null }, "location": { "city": "Amsterdam", "state": "Noord-Holland", "countryOrRegion": "NL",  
"geoCoordinates": { "altitude": null, "latitude": 52.309051513671875, "longitude": 4.940189838409424 } }  
, "appliedConditionalAccessPolicies": , "authenticationProcessingDetails": , "networkLocationDetails": , "authenticationDetails": [  
{ "authenticationStepDateTime": "2020-01-05T12:13:51.0690981Z", "authenticationMethod": "CloudOnlyPassword", "authenticationMethodDet  
ail": "", "succeeded": false, "authenticationStepResultDetail": "User account is disabled. The account has been disabled by an administrator.",  
"authenticationStepRequirement": "Primary Authentication" } ], "authenticationRequirementPolicies": }, { "id": "5b6fb004-53

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2020, 5:15pm UTC](https://discuss.elastic.co/t/parsing-pulling-data-from-eventhub/213814/2 "2020-02-02T17:15:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.