# Registry.data.string is null

**URL:** <https://discuss.elastic.co/t/registry-data-string-is-null/272085>\
**Category:** Beats\
**Created:** [May 4, 2021, 3:32pm UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085 "2021-05-04T15:32:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nil\_Battey\_Sannata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nil_battey_sannata/32/87040_2.png) [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\
**Post date:** [May 4, 2021, 3:32pm UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085/1 "2021-05-04T15:32:17Z")

</div>

As per below logs from endpoint the field name from kibana `registry.data.string` should contain the value of data string from ImagePath, but it is giving Null value. the data which I want to be in `registry.data.string` it is coming under `winlog.event_data.Details`  
Can someone please explain?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/efd9db104b447d4882cbb00403b724fb91261fb7.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/26497593edc33353186092ea43b8077d52e3a87d.png)

---

<div class="post-metadata">

**Author:** ![Nil\_Battey\_Sannata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nil_battey_sannata/32/87040_2.png) [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\
**Post date:** [May 6, 2021, 9:28am UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085/2 "2021-05-06T09:28:07Z")

</div>

Any suggestions?

---

<div class="post-metadata">

**Author:** ![Nil\_Battey\_Sannata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nil_battey_sannata/32/87040_2.png) [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\
**Post date:** [May 7, 2021, 3:43am UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085/3 "2021-05-07T03:43:48Z")

</div>

Need help

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [May 7, 2021, 9:39am UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085/4 "2021-05-07T09:39:36Z")

</div>

Since I don't use winlogbeat I can only assume that is how the module is set to parse the data. Look here, [https://www.github.com/elastic/beats/tree/master/x-pack%2Fwinlogbeat%2Fmodule](https://www.github.com/elastic/beats/tree/master/x-pack%2Fwinlogbeat%2Fmodule), to see the scripts used for each module. If u think our should be different, submit an issue on GitHub.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2021, 9:40am UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085/5 "2021-06-04T09:40:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.