# Server send security events with WEF and in Authentication tab I don't found all accesses

**URL:** <https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221>\
**Category:** SIEM\
**Created:** [February 13, 2020, 2:02pm UTC](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221 "2020-02-13T14:02:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\
**Post date:** [February 13, 2020, 2:02pm UTC](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221/1 "2020-02-13T14:02:37Z")

</div>

Hi all

I'm using Elastic Stack v7.4.0 and I have a single winlogbeat on the Windows Server that receive with WEF all event of security of differents other server.

So I just correct by logstash, that I used to filter all traffic to Elasticsearch, the content of field host.name with the value of winlog.computer\_name.

Now I see in the host tab all servers but in authentication I don't see the accesses. I collect the information of different DC. What could I do? At the moment I see the user access in the field winlog.event\_data.TargetUserName. Could I move the content of field winlog.event\_data.TargetUserName in user.name?

Thank you  
Franco

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2020, 2:02pm UTC](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221/2 "2020-03-12T14:02:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.