# Questions about windows logins with winlogbeat

**URL:** <https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 20, 2017, 3:23am UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639 "2017-10-20T03:23:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [October 20, 2017, 3:23am UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639/1 "2017-10-20T03:23:27Z")

</div>

Looking at [https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat)

I think I'm good except for ...

Saved "field" parameter is now invalid. Please select a new field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef52f97f7d1d35e0cb19bede716ffbf72494aaa1.png)

Any suggestions?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 24, 2017, 12:51pm UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639/2 "2017-10-24T12:51:04Z")

</div>

I seem to recall seeing this in another post. After you have data ingested can you please try to [refresh the Kibana index pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html#reload-fields).

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [October 24, 2017, 3:11pm UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639/3 "2017-10-24T15:11:45Z")

</div>

Haha well, I got it working but then I lost all my fields on windows filtering and powershell filtering.... I went from over 100 fields to around 75 under winlogbeats.

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [October 25, 2017, 2:23pm UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639/4 "2017-10-25T14:23:40Z")

</div>

Ugh, I got it, sorry for all the stupid questions... gotta get some training!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2017, 2:23pm UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639/5 "2017-11-22T14:23:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.