# Powershell and param3 keywords missing

**URL:** <https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 8, 2017, 10:48pm UTC](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988 "2017-05-08T22:48:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [May 8, 2017, 10:48pm UTC](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988/1 "2017-05-08T22:48:16Z")

</div>

Elastic Stack 5.4, running a lab, forwarding 400, 500, and 501 events -- but I can't see event\_data.param3.keyword as a dashboard option --

 ![](https://us1.discourse-cdn.com/elastic/original/3X/6/1/611371f1aa4373367ca3415c5ec191448c4a0cc7.jpg)

On Discovery I can see event\_data.param3 but not event\_data.param3 keyword...

 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e40a7a3b3702ced9150055a4a8647acd309c9fcb.jpg)

and then under Management param3.keyword says it isn't searchable or aggregatable...

 ![](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aaf3c4bba64f07a6b2ddbfc1d281d7038ef81daf.jpg)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 8, 2017, 11:47pm UTC](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988/2 "2017-05-08T23:47:47Z")

</div>

It looks as if you do not have the provided index template installed for the Winlogbeat. See [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html).

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [May 11, 2017, 8:46pm UTC](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988/3 "2017-05-11T20:46:07Z")

</div>

Yep, that was it... thanks Andrew I'm sure we'll have another question here soon.

This is awesome!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 8:50pm UTC](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988/4 "2017-06-08T20:50:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.