Version: v5.3.0 Operating System: Windows 2003 64bit Steps to Reproduce: When collector EventID 1111 record, it produce“The system cannot find message text for message number 1111 in the message file for C:\WINDOWS\System32\ws03res.dll.” But splunk render it success.

Why WinlogBeat cannot render EventID 1111 message?

system (system) Closed May 15, 2017, 10:21am 5

This topic was automatically closed after 21 days. New replies are no longer allowed.

Topic		Replies	Views
Winlogbeat message_error: "The system cannot find the file specified." Beats winlogbeat	13	4191	August 16, 2016
Winlogbeat reports wrong event_id on Windows Server 2003 Beats winlogbeat	3	1296	April 12, 2016
Winlogbeat for windows 10 Beats winlogbeat	3	470	August 6, 2019
Winlogbeat can't send event id 4663, 4660 Beats	1	808	January 13, 2019
Winlogbeat not capturing specific event id's in windows server 2012 Beats winlogbeat	3	960	July 3, 2018