# Runtime error: slice bounds out of range when ingesting Powershell logs

**URL:** <https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range-when-ingesting-powershell-logs/268699>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 29, 2021, 8:34pm UTC](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range-when-ingesting-powershell-logs/268699 "2021-03-29T20:34:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruffy91](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruffy91/32/86246_2.png) [@ruffy91](https://discuss.elastic.co/u/ruffy91)\
**Post date:** [March 29, 2021, 8:34pm UTC](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range-when-ingesting-powershell-logs/268699/1 "2021-03-29T20:34:05Z")

</div>

I am trying to ingest Powershell logs using winlogbeat 7.12 using the following configuration:

```auto
- name: WEC-Powershell
  tags: [forwarded]
  processors:
    - script:
      when.equals.winlog.channel: Windows-PowerShell
      lang: javascript
      id: security
      file: ${path.home}/module/security/config/winlogbeat-security.js

```

But when I do this I get the following error when starting winlogbeat and winlogbeat immediately crashes

```auto
2021-03-29T13:24:10.447-0700	INFO	beater/eventlogger.go:129	EventLog[WEC-Powershell] Stop processing.
panic: runtime error: slice bounds out of range [:18506] with capacity 16384

goroutine 1187 [running]:
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.FormatEventString(0xc000000009, 0x100003c, 0xc006d04cd0, 0xa, 0x2000074, 0x0, 0xc001068000, 0x4000, 0x4000, 0x333bb60, ...)
	/go/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/wineventlog_windows.go:419 +0x405
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.RenderEvent(0x100003c, 0xc000000000, 0xc001068000, 0x4000, 0x4000, 0xc0042070c0, 0x333bb60, 0xc00095d140, 0xc004207640, 0x40)
	/go/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/wineventlog_windows.go:241 +0x112
github.com/elastic/beats/v7/winlogbeat/eventlog.newWinEventLog.func4(0x100003c, 0x333bb60, 0xc00095d140, 0x69, 0x0)
	/go/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:433 +0xa7
github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).Read(0xc0002d3400, 0x0, 0x0, 0x0, 0x0, 0x0)
	/go/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:251 +0x295
github.com/elastic/beats/v7/winlogbeat/beater.(*eventLogger).run(0xc000909b30, 0xc0001cd140, 0x33584c0, 0xc00050a280, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	/go/src/github.com/elastic/beats/winlogbeat/beater/eventlogger.go:147 +0x46e
github.com/elastic/beats/v7/winlogbeat/beater.(*Winlogbeat).processEventLog(0xc00019a1c0, 0xc000da3310, 0xc000909b30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:174 +0xd6
created by github.com/elastic/beats/v7/winlogbeat/beater.(*Winlogbeat).Run
	/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:142 +0x35a

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2021, 10:34pm UTC](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range-when-ingesting-powershell-logs/268699/2 "2021-04-26T22:34:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.