# Windows Event Viewer Logs Parsing without Winlogbeat

**URL:** <https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710>\
**Category:** Logstash\
**Created:** [August 12, 2020, 12:09pm UTC](https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710 "2020-08-12T12:09:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Post date:** [August 12, 2020, 12:09pm UTC](https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710/1 "2020-08-12T12:09:38Z")

</div>

Constraint: logs are coming in collected by Splunk, forwarded, along with many other log sources, to logstash. So no winlogbeat, no logstash-input-eventlog plugin. We have to pick out the Windows events from the flood of logs, and parse them in logstash. Picking them out is easy enough. However, parsing them seems problematic because the Windows log format is wonky. The first twelve or so fields are nicely formatted with fieldname=value, then it starts going to fieldname:value.

Surely someone has had to parse these events in logstash before right? Can you share the filter you used?

Here is an example log

> "\<13\> dc01 08/11/2020 10:58:31 AM\n\tLogName=Security\n\tSourceName=Microsoft Windows security auditing.\n\tEventCode=4624\n\tEventType=0\n\tType=Information\n\tComputerName=dc01.acme.local\n\tTaskCategory=Logon\n\tOpCode=Info\n\tRecordNumber=4796622\n\tKeywords=Audit Success\n\tMessage=An account was successfully logged on.\r\n\t\Subject:\r\n\tSecurity ID:S-1-0-0\r\n\tAccount Name:-\r\n\tAccount Domain:-\r\n\tLogon ID:0x0\r\n\tLogon Information:\r\n\tLogon Type:3\r\n\tRestricted Admin Mode:-\r\n\tVirtual Account:No\r\n\tElevated Token:Yes\r\n\t\Impersonation Level:Impersonation\r\n\t\r\n\tNew Logon:\r\n\tSecurity ID:S-1-5-21-2344382208-301227701-2769393404-17886\r\n\tAccount Name:svc-acme\r\n\tAccount Domain:acme.LOCAL\r\n\tLogon ID:0x88AF090D\r\n\tLinked Logon ID:0x0\r\n\tNetwork Account Name:-\r\n\tNetwork Account Domain:-\r\n\tLogon GUID:{25332F90-F62B-A867-DC37-689B2B97A186}\r\n\t\r\n\tProcess Information:\r\n\tProcess ID:0x0\r\n\tProcess Name:-\r\n\t\Network Information:\r\n\tWorkstation Name:-\r\n\tSource Network Address:10.1.1.12\r\n\tSource Port:53477\r\n\t\r\n\tDetailed A",

I first tried

> #Delete \t and \r from messages  
> mutate{  
> gsub =\> ["message", "\t", ""]  
> }  
> kv{  
> source =\> "message"  
> value\_split =\> "="  
> field\_split =\> "\n"  
> }

and that worked good for the first 12 fields, but then I am left with a bunch of unparsed items, separated by \r and :'s. I have no idea if I can parse them again using another mutate. Thoughts?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 12, 2020, 3:37pm UTC](https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710/2 "2020-08-12T15:37:53Z")

</div>

You could use a second kv filter

```
kv{ source => "message" value_split => "=" field_split => "\n" }
kv{ source => "message" value_split => ":" field_split => "\n" }

```

The results need some cleaning up but it gets you most of the way.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2020, 3:37pm UTC](https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710/3 "2020-09-09T15:37:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.