# User ID cannot be displayed properly

**URL:** https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341
**Category:** Beats
**Tags:** winlogbeat
**Created:** [January 23, 2019, 6:05am UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341 "2019-01-23T06:05:58Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![jingzhao](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jingzhao](https://discuss.elastic.co/u/jingzhao)
#### Post date: [January 23, 2019, 6:05am UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341/1 "2019-01-23T06:05:58Z")

</div>

User ID cannot be displayed properly

 ![winbeatlog](https://us1.discourse-cdn.com/elastic/original/3X/4/5/450ceb8d9d470392dac9d29e87230cf018e9c9c0.jpeg)

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 27, 2019, 4:20pm UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341/2 "2019-01-27T16:20:44Z")

</div>

When you say that it's not displayed properly what exactly do you mean?

Winlobeat just passes the `event_data` fields through from what it finds in the event log. You should be able to open up the Event Viewer, find this log message by using the `record_number`, view the raw XML representation of the event, and verify that they are equivalent.

Perhaps you want to be able to translate SID values to names? [https://github.com/elastic/beats/issues/7451](https://github.com/elastic/beats/issues/7451)

---

<div class="post-metadata">

### Author: ![jingzhao](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jingzhao](https://discuss.elastic.co/u/jingzhao)
#### Post date: [January 28, 2019, 8:30am UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341/3 "2019-01-28T08:30:03Z")

</div>

yes！I want to be able to translate SID values to names，  
I've seen this [https://github.com/elastic/beats/issues/7451](https://github.com/elastic/beats/issues/7451)  
I also read a lot of solutions you wrote to solve the problem of change.  
But I don't understand. Is this translation a function of Winlogbeat, or does it need to be debugged by myself?  
I am from China and my English is poor. Please forgive me.

---

<div class="post-metadata">

### Author: ![jingzhao](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jingzhao](https://discuss.elastic.co/u/jingzhao)
#### Post date: [January 28, 2019, 8:34am UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341/4 "2019-01-28T08:34:18Z")

</div>

thank you for your reply!

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 28, 2019, 4:10pm UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341/5 "2019-01-28T16:10:28Z")

</div>

> [@jingzhao](#):
>
> But I don't understand. Is this translation a function of Winlogbeat, or does it need to be debugged by myself?

Translation of SIDs to names is not a feature yet.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 25, 2019, 4:10pm UTC](https://discuss.elastic.co/t/user-id-cannot-be-displayed-properly/165341/6 "2019-02-25T16:10:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.