# Parsing Windows DHCP Logs with Filebeat Microsoft Module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 12, 2021, 3:26pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849 "2021-01-12T15:26:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![MakoWish](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Post date:** [January 12, 2021, 3:26pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849/1 "2021-01-12T15:26:00Z")
I somehow lost track of the previous thread regarding this issue, and it ended up closing due to inactivity. I am still seeing this same problem now on 7.10.1. Related thread: > [@Parsing Windows DHCP Logs with Filebeat Microsoft Module](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/254814): > > Hello, We're trying to use the new microsoft.yml module in Filebeat 7.9.0 to ingest and parse Windows DHCP logs. The configuration seems pretty straightfoward, we just pointed it to the default C:\Windows\System32\dhcp\Dhcp\*.log path and it's successfully picking up and ingesting logs to Elasticsearch using the filebeat-7.9.0-microsoft-dhcp-pipeline pipeline. The problem is that we're not seeing the actual log message (event.original field) being parsed and the log.flags field says "dissect\_pa… Has this been looked into any more? ---
**Author:** ![MakoWish](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Post date:** [February 3, 2021, 10:34pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849/2 "2021-02-03T22:34:17Z")
Still looking for any info on this. We are now on 7.10.2 throughout the stack and still seeing this parse failure. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [February 4, 2021, 4:52pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849/3 "2021-02-04T16:52:32Z")
Hi @MakoWish, can you share some logs with me? Feel free to send them via private message and redact them as necessary. ---
**Author:** ![MakoWish](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Post date:** [February 4, 2021, 5:17pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849/4 "2021-02-04T17:17:22Z")
Hi Adrian, I did paste some redacted sample log lines in the previous thread. Here those are again: ```auto Microsoft DHCP Service Activity Log Event ID Meaning 00 The log was started. 01 The log was stopped. 02 The log was temporarily paused due to low disk space. 10 A new ip_address was leased to a client. 11 A lease was renewed by a client. 12 A lease was released by a client. 13 An ip_address was found to be in use on the network. 14 A lease request could not be satisfied because the scope's address pool was exhausted. 15 A lease was denied. 16 A lease was deleted. 17 A lease was expired and DNS records for an expired leases have not been deleted. 18 A lease was expired and DNS records were deleted. 20 A BOOTP address was leased to a client. 21 A dynamic BOOTP address was leased to a client. 22 A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted. 23 A BOOTP ip_address was deleted after checking to see it was not in use. 24 ip_address cleanup operation has began. 25 ip_address cleanup statistics. 30 DNS update request to the named DNS server. 31 DNS update failed. 32 DNS update successful. 33 Packet dropped due to NAP policy. 34 DNS update request failed.as the DNS update request queue limit exceeded. 35 DNS update request failed. 36 Packet dropped because the server is in failover standby role or the hash of the client ID does not match. 50+ Codes above 50 are used for Rogue Server Detection information. QResult: 0: NoQuarantine, 1:Quarantine, 2:Drop Packet, 3:Probation,6:No Quarantine Information ProbationTime:Year-Month-Day Hour:Minute:Second:MilliSecond. ID,Date,Time,Description,ip_address,Host Name,MAC Address,User Name, TransactionID, QResult,Probationtime, CorrelationID,Dhcid,VendorClass(Hex),VendorClass(ASCII),UserClass(Hex),UserClass(ASCII),RelayAgentInformation,DnsRegError. 24,11/20/20,00:00:05,Database Cleanup Begin,,,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 17,11/20/20,00:00:05,DNS record not deleted,,,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 31,11/20/20,00:00:05,DNS Update Failed,,hostname.contoso.com,,,0,6,,,,,,,,,9005 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 30,11/20/20,00:00:05,DNS Update Request,,hostname.contoso.com,,,0,6,,,,,,,,,0 ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 4, 2021, 7:18pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849/5 "2021-03-04T19:18:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.