# Why the messages I collected are not displayed completely

**URL:** <https://discuss.elastic.co/t/why-the-messages-i-collected-are-not-displayed-completely/326073>\
**Category:** 中文提问与讨论\
**Created:** [February 21, 2023, 1:50pm UTC](https://discuss.elastic.co/t/why-the-messages-i-collected-are-not-displayed-completely/326073 "2023-02-21T13:50:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NardRage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nardrage/32/117253_2.png) [@NardRage](https://discuss.elastic.co/u/NardRage)\
**Post date:** [February 21, 2023, 1:50pm UTC](https://discuss.elastic.co/t/why-the-messages-i-collected-are-not-displayed-completely/326073/1 "2023-02-21T13:50:39Z")

</div>

[错误] %1 (%2) %3 错误的页面链接 (错误 %4) 在 B 树中检测到 (ObjectId：%5，PgnoRoot：%6) 的数据库 %7 (%8 =\> %9，%10)。  
标记：%11  
致命： %12

---

<div class="post-metadata">

**Author:** ![NardRage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nardrage/32/117253_2.png) [@NardRage](https://discuss.elastic.co/u/NardRage)\
**Post date:** [February 21, 2023, 1:51pm UTC](https://discuss.elastic.co/t/why-the-messages-i-collected-are-not-displayed-completely/326073/2 "2023-02-21T13:51:46Z")

</div>

# ---------------input 输入模块-----------------------

input{  
beats{ #winlogbeat为数据源，使用beats插件  
type =\> "winlog\_security" #输入数据打上winlog\_security 类型  
host =\> "0.0.0.0" #接收任意主机数据  
port =\> 6515 #定义端口，需和采集器配置一致  
codec =\> plain{ charset =\> "UTF-8" }  
}  
}

# ---------------filter 过滤模块-----------------------

filter{  
if [type] == "winlog\_security" { #此文件的数据源才过滤处理  
date{  
match =\> ["event.time","dd/MMM/yyyy:HH:mm:ss Z"]  
}  
ruby{  
code =\> "event.set('event.time', event.get('@timestamp').time.localtime + 8_60_60)"

```
     }
     mutate{ #删除不需要的字段
             copy => {"[@metadata][ip_address]" => "serverip"}
             
            # remove_field => ["[agent]","@version","[process]","tags"]
            # remove_field => ["task","api","keywords","record_id"]
            # remove_field => ["[ecs]","[log]","[winlog_channel]"]
            # remove_field => ["[keywords]","provider_guid"]
            # remove_field => ["[os]","opcode","id","related","kind","message","[event]"]
     }
    # if ([winlog][event_data][LogonType] == "3") { #由于只是需要用户安全登录日志，将一些系统的登录日志删除
    # drop {}
    # }
    # if ([winlog][event_data][LogonType] == "5") {
    # drop {}
    # }
    # if ([user][domain] == "Window Manager") {
    # drop {}
    # }
  }

```

}

# ---------------output 输出模块-----------------------

output{  
if [type] == "winlog\_security" {  
elasticsearch { #输出到es  
hosts =\> ["192.168.21.33:9200"]  
index =\> "winlog\_security-%{+yyyy.MM.dd}" #创建索引  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2023, 1:52pm UTC](https://discuss.elastic.co/t/why-the-messages-i-collected-are-not-displayed-completely/326073/3 "2023-03-21T13:52:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.