Parsing Windows DHCP Logs with Filebeat Microsoft Module

I somehow lost track of the previous thread regarding this issue, and it ended up closing due to inactivity. I am still seeing this same problem now on 7.10.1.

Related thread:

Has this been looked into any more?

Still looking for any info on this. We are now on 7.10.2 throughout the stack and still seeing this parse failure.

Hi @MakoWish, can you share some logs with me?

Feel free to send them via private message and redact them as necessary.

Hi Adrian,

I did paste some redacted sample log lines in the previous thread. Here those are again:

		Microsoft DHCP Service Activity Log


Event ID  Meaning
00	The log was started.
01	The log was stopped.
02	The log was temporarily paused due to low disk space.
10	A new ip_address was leased to a client.
11	A lease was renewed by a client.
12	A lease was released by a client.
13	An ip_address was found to be in use on the network.
14	A lease request could not be satisfied because the scope's address pool was exhausted.
15	A lease was denied.
16	A lease was deleted.
17	A lease was expired and DNS records for an expired leases have not been deleted.
18	A lease was expired and DNS records were deleted.
20	A BOOTP address was leased to a client.
21	A dynamic BOOTP address was leased to a client.
22	A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
23	A BOOTP ip_address was deleted after checking to see it was not in use.
24	ip_address cleanup operation has began.
25	ip_address cleanup statistics.
30	DNS update request to the named DNS server.
31	DNS update failed.
32	DNS update successful.
33	Packet dropped due to NAP policy.
34	DNS update request failed.as the DNS update request queue limit exceeded.
35	DNS update request failed.
36	Packet dropped because the server is in failover standby role or the hash of the client ID does not match.
50+	Codes above 50 are used for Rogue Server Detection information.

QResult: 0: NoQuarantine, 1:Quarantine, 2:Drop Packet, 3:Probation,6:No Quarantine Information ProbationTime:Year-Month-Day Hour:Minute:Second:MilliSecond.

ID,Date,Time,Description,ip_address,Host Name,MAC Address,User Name, TransactionID, QResult,Probationtime, CorrelationID,Dhcid,VendorClass(Hex),VendorClass(ASCII),UserClass(Hex),UserClass(ASCII),RelayAgentInformation,DnsRegError.
24,11/20/20,00:00:05,Database Cleanup Begin,,,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
17,11/20/20,00:00:05,DNS record not deleted,<ip_address>,,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
31,11/20/20,00:00:05,DNS Update Failed,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,9005
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0
30,11/20/20,00:00:05,DNS Update Request,<ip_address>,hostname.contoso.com,,,0,6,,,,,,,,,0

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.