Source.ip.keyword insted of source.ip

[Adriann (Adrian)]

Refreshing the index pattern resolved the issue.

Winlogbeat missing mapping fields

Hi Adriann, Did you refresh your Kibana index patterns? I do not know the powershell dashboard but I do know the other one (User Management Events) because i was the one I did it. Regarding to winlog.logon.id is a very useful field because it allows you to correlate different events performed by the same user, if it is not in the index pattern is dynamically generated (when you receive an event with that field) . From winlogbeat's Index Template: { "strings_as_keyword": { …