Hello everybody, I'm new working with the ELK stack. Actually I realized that it seems to be impossible to get the details of events with Winlogbeat. Only the General (or System in XML view) section is parsed. Did I miss any configuration setting or is this planned for future versions? Thanks …

Hi @snbart1 , this has been implemented. See my message here: Winlogbeat and User sessions (parsing fields from message)

Discuss the Elastic Stack

Pulling details of an event entry with Winlogbeat

Elastic Stack Beats

snbart1 (Sebastian) March 7, 2016, 12:09pm 3

Hi Andrew,

thanks for your quick reply.
What's the rough timeline until seeing this implemented?

Topic		Replies	Views
Winlogbeats not exporitng event.id or xml data Beats winlogbeat	10	1318	July 6, 2018
Winlogbeat data is not parsing properly Beats winlogbeat	9	1545	June 7, 2020
Message filed is missing when Winlogbeat is used Beats winlogbeat	12	2598	October 10, 2017
Winlogbeat for XP Beats winlogbeat	2	1841	January 17, 2018
Event messages are splitted in event_data.param xy? How to fix that? Beats winlogbeat	5	2960	October 28, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Pulling details of an event entry with Winlogbeat

Related topics