# Why WinlogBeat cannot render EventID 1111 message?

**URL:** <https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400>\
**Category:** Beats\
**Created:** [April 24, 2017, 10:20am UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400 "2017-04-24T10:20:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tianlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tianlin/32/25540_2.png) [@tianlin](https://discuss.elastic.co/u/tianlin)\
**Post date:** [April 24, 2017, 10:20am UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400/1 "2017-04-24T10:20:57Z")

</div>

- Version: v5.3.0
- Operating System: Windows 2003 64bit
- Steps to Reproduce: When collector EventID 1111 record, it produce“The system cannot find message text for message number 1111 in the message file for C:\WINDOWS\System32\ws03res.dll.”

But splunk render it success.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 24, 2017, 12:59pm UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400/2 "2017-04-24T12:59:39Z")

</div>

For the same event log record with the error (using the the record number to ensure they are the same), could you please share what the Windows Event Viewer shows for this record? And what splunk shows for the record?

---

<div class="post-metadata">

**Author:** ![tianlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tianlin/32/25540_2.png) [@tianlin](https://discuss.elastic.co/u/tianlin)\
**Post date:** [April 25, 2017, 12:53am UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400/3 "2017-04-25T00:53:39Z")

</div>

This is result of splunk:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c0fd0ae5904a2bbd2670bc555d83ec1623710b2c.png)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 25, 2017, 11:51am UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400/4 "2017-04-25T11:51:45Z")

</div>

> [@andrewkroh](#):
>
> could you please share what the Windows Event Viewer shows for this record?

What does the Windows Event Viewer show for Record Number=1431 in the System log on host=SPCEMC?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2017, 10:21am UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400/5 "2017-05-15T10:21:01Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.