# Windows Event Log filtering **URL:** \ **Category:** Logstash\ **Created:** [June 21, 2016, 7:49am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448 "2016-06-21T07:49:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![brandonmcgrath1](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@brandonmcgrath1](https://discuss.elastic.co/u/brandonmcgrath1)\ **Post date:** [June 21, 2016, 7:49am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/1 "2016-06-21T07:49:41Z")
So, I'm trying to upgrade my logstash conf file to filter the windows event logs and make them more useful. At the moment the log dumps loads of information into one field called "message", like so: {"EventTime":"2016-06-21 08:37:21","Hostname":"WINDOWS-9NOTMBF.etech.local","Keywords":-9214364837600034816,"EventType":"AUDIT\_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":5564,"ProcessID":840,"ThreadID":7096,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWINDOWS-9NOTMBF$\r\n\tAccount Domain:\t\tETECH\r\n\tLogon ID:\t\t0x3E7\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tBrandonMcGrath\r\n\tAccount Domain:\t\tETECH\r\n\tLogon GUID:\t\t{B66720EA-C940-0098-E15D-E9F999495C98}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x348\r\n\tProcess Name:\t\tC:\Windows\System32\lsass.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDOWS-9NOTMBF$","SubjectDomainName":"ETECH","SubjectLogonId":"0x3e7","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"BrandonMcGrath","TargetDomainName":"ETECH","TargetLogonGuid":"{B66720EA-C940-0098-E15D-E9F999495C98}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\Windows\System32\lsass.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":1466494642,"SourceModuleName":"eventlog","SourceModuleType":"im\_msvistalog"} Is there a way to seperate them into seperate lines rather than in one big message? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 21, 2016, 7:59am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/2 "2016-06-21T07:59:34Z")
Use a json codec for your beats input. ```auto input { beats { ... codec => json } } ``` ---
**Author:** ![brandonmcgrath1](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@brandonmcgrath1](https://discuss.elastic.co/u/brandonmcgrath1)\ **Post date:** [June 21, 2016, 8:03am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/3 "2016-06-21T08:03:09Z")
that didnt work, it still dumps 90% of the info into "message" :-\ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 21, 2016, 8:27am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/4 "2016-06-21T08:27:09Z")
That's fishy. Please post the output from a `stdout { codec => rubydebug }` output. And what if you instead use a json filter for the JSON parsing? ---
**Author:** ![brandonmcgrath1](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@brandonmcgrath1](https://discuss.elastic.co/u/brandonmcgrath1)\ **Post date:** [June 21, 2016, 10:39am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/5 "2016-06-21T10:39:40Z")
I have solved that issue now, thanks. But, there is something else if you can help. Basically, Elasticsearch Logs are getting completely filled up to like 50gb in a day because of an exception error with topbeat. I uinstalled topbeat, filebeat etc because they were causing too many errors. But, I think I uninstalled them wrong and Elasticsearch is still looking for them and its causing so many issues. Any idea on how I can fix it? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 21, 2016, 10:44am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/6 "2016-06-21T10:44:02Z")
ES doesn't know about or look for Topbeat or Filebeat. You can use ES's REST APIs to delete the old indexes if you want to clean things up. You're not being very specific about the problems you're experiencing so it's hard to offer specific help. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 22, 2016, 11:01pm UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/7 "2016-06-22T23:01:17Z")
Can you share the solution? It might help someone in the future. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/windows-event-log-filtering/53448/8 "2017-07-06T04:51:04Z")