Hello everybody, I'm new working with the ELK stack. Actually I realized that it seems to be impossible to get the details of events with Winlogbeat. Only the General (or System in XML view) section is parsed. Did I miss any configuration setting or is this planned for future versions? Thanks …

Pulling details of an event entry with Winlogbeat

andrewkroh (Andrew Kroh) March 21, 2016, 2:49pm 5

Hi @snbart1, this has been implemented. See my message here: Winlogbeat and User sessions (parsing fields from message)

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.