# The audit log integration process.args log entry only contains the user.id field; it does not contain the user.name field. Please suggest!It's urgent! **URL:** \ **Category:** Endpoint Security\ **Created:** [February 12, 2025, 7:38am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400 "2025-02-12T07:38:55Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 12, 2025, 7:38am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/1 "2025-02-12T07:38:55Z")
Hello Team, I'm using the audit integration to parse audit logs. For the audit record type `USER_CMD`, the `user.name` field is not being mapped; only the `user.id` is present. The log entry contains `AUID`, which represents the `user.name`, but it is not displaying in Kibana. Why is this happening? ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/4804e134b31cd95169e959c6b6fc509d108710ff.png) ```auto grep "/home/manjunath/editnginx.sh" audit.log type=USER_CMD msg=audit(1735732.627:1409): pid=1703 uid=104 auid=104 ses=222 subj=unconfined msg='cwd="/home/manjunath" cmd="/home/manjunath/editnginx.sh" exe="/usr/bin/sudo" terminal=pts/0 res=success'UID="manjunath" AUID="manjunath" ``` How can i change the pipeline to add the AUID field to print the value ---
**Author:** ![Maxwell\_Borden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxwell_borden/32/122811_2.png) [@Maxwell\_Borden](https://discuss.elastic.co/u/Maxwell_Borden)\ **Post date:** [February 12, 2025, 5:43pm UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/2 "2025-02-12T17:43:11Z")
Hi evangelin, Can you share which version of the integration you have installed, and how you installed it? ---
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 13, 2025, 6:32am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/3 "2025-02-13T06:32:00Z")
Hello Maxwell\_Borden, Thanks for you reply! I have installed the elastic agent in end point where i want to send the logs to ELK, The Elastic agent version is 8.14.3 and the integration version is 3.19.2 i added the policy to the elastic agent and attached the audit log integration ---
**Author:** ![Maxwell\_Borden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxwell_borden/32/122811_2.png) [@Maxwell\_Borden](https://discuss.elastic.co/u/Maxwell_Borden)\ **Post date:** [February 13, 2025, 2:44pm UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/4 "2025-02-13T14:44:58Z")
This looks to me like the same issue as was fixed [here](https://github.com/elastic/integrations/pull/12284) in integration version 3.20.3 , where an enriched format log with a msg='...' field was not parsed correctly, can you try with that newer ingest pipeline? ---
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 14, 2025, 4:17am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/5 "2025-02-14T04:17:15Z")
Do i need to create a new ingest pipeline now and add integration to that? Actually when i search for the pipeline in stack management \> ingest pipeline there are 2 pipeline [logs-auditd.log-3.19.2] and [logs-auditd.log-3.15.0] this 3.15.0 pipeline is storing the AUID value but 3.19.2 is not! But the integration is using 3.19.2 pipeline only how can i change it to 3.15.0 ---
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 18, 2025, 6:08am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/6 "2025-02-18T06:08:09Z")
Please reply i'm new to ELK idk how to do and what to do ! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 18, 2025, 12:09pm UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/7 "2025-02-18T12:09:55Z")
You cannot change the ingest pipeline used by the integration, if the integration is on version 3.19.2 it will use the ingest pipeline with this version. The old pipeline should've been deleted, probably it wasn't deleted because of some bug. If you are having any issue with the parsing of an integration the first thing to do is to upgrade to the last version, in this case is version `3.21.0`. See if you can upgrade to this version. ---
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 18, 2025, 1:30pm UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/10 "2025-02-18T13:30:46Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d665aa7ec6722ada10100363a5cd2139b8420fb3.png) the which im using is the latest version in mine 🙁 ---
**Author:** ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)\ **Post date:** [February 19, 2025, 7:37am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/11 "2025-02-19T07:37:15Z")
Hello! It seems 3.19.2 [was the latest version supporting Kibana versions under 8.11](https://github.com/elastic/integrations/pull/10417/files#diff-38f40c3d356c6e33c7081112d7dff7d8b909851d39caa1ae53c771ad7edcf788). You mentioned you are using elastic agent 8.14.3, does the Kibana version correspond with this or is it older than 8.11? If that is the case the only way to be able to see newer versions of the integrations is by upgrading it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2025, 7:38am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400/12 "2025-03-19T07:38:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.