Hello all, I have been running into the issue, that after updating my On-Prem Elastic-Stack (Single-node cluster) from v. 8.18 to 8.19 and the system integration for fleet as well, that the Windows security logs are missing some fields, or to be precise everything with user.*. Logs are still sent, …

System Integration Windows Security Logs no Log Enhancements after v. 8.19

Joshua_H (Joshua) October 8, 2025, 2:10pm 3

Hello, I still have not found any solutions to this issue. Is there someone able to assist in any way? Thank you.

Topic		Replies	Views
Winlog.provider_name not populated in 9.1.0 Elastic Security	3	123	August 12, 2025
Errors with filebeat when trying to integrate any windows integration logs with the agent Elastic Agent filebeat	26	342	August 7, 2025
Elastic Agent Custom Windows Event Logs Beats winlogbeat	5	4610	June 15, 2022
Elastic Agent System integration not collecting Windows Event Log Beats docker , fleet	2	3672	January 13, 2023
Winlogbeat - no winlog.logon.id Beats winlogbeat	22	2822	September 14, 2020