Windows event message field

Elastic Stack Beats
1

Hi,
how can I parse message string to seperate lines?
Example:
Line1 = An account was logged off.

Subject:
Line2 = Security ID: XXXX
Line3 = Account Name: XXXX
Line4 = Account Domain: XXX
Line5 = Logon ID: 0xXXXXX

Line6 = Logon Type: 3

Line7 = This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

Now if I want create Data Table i can't use this field on split rows sub aggregation Terms and in Field this message filed not show.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.