# Winlogbeat 5.0 mapper\_parsing\_exception from Elasticsearch **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [August 4, 2016, 1:38pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223 "2016-08-04T13:38:51Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 4, 2016, 1:38pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/1 "2016-08-04T13:38:51Z")
Hi I am using Winlogbeat 5.0.0-alpha4 and am having trouble reading in the following event log `Log Name: Application Source: Group Policy Local Users and Groups Date: 04/08/2016 14:08:22 Event ID: 4098 Task Category: (2) Level: Warning Keywords: Classic User: SYSTEM Computer: SETHER01.support.local Description: The computer 'Administrator (built-in)' preference item in the 'Local Administrator Policy {7505FF97-CD2C-44B3-8667-8842768657BC}' Group Policy Object did not apply because it failed with error code '0x8007052a This operation is disallowed as it could result in an administration account being disabled, deleted or unable to logon.' This error was suppressed. Event Xml: 4098 3 2 0x80000000000000 26907 Application SETHER01.support.local computer Administrator (built-in) Local Administrator Policy {7505FF97-CD2C-44B3-8667-8842768657BC} 0x8007052a This operation is disallowed as it could result in an administration account being disabled, deleted or unable to logon. ` When getting to logstash I am getting the following issue `beat"=>{"name"=>"SETHER01", "hostname"=>"SETHER01"}, "log_name"=>"Application", "event_id"=>4098, "event_data"=>{"param2"=>"Administrator (built-in)", "param3"=>"Local Administrator Policy {7505FF97-CD2C-44B3-8667-8842768657BC}", "param4"=>"0x8007052a This operation is disallowed as it could result in an administration account being disabled, deleted or unable to logon.", "param1"=>"computer"}, "level"=>"Warning", "keywords"=>["Classic"], "user"=>{"identifier"=>"S-1-5-18", "name"=>"SYSTEM", "domain"=>"NT AUTHORITY", "type"=>"User"}, "tags"=>["support.local", "beats", "beats_input_codec_plain_applied", "_grokparsefailure"], "type"=>"wineventlog", "source_name"=>"Group Policy Local Users and Groups", "computer_name"=>"SETHER01.support.local", "host"=>"SETHER01"}, "event_data.AuthenticationPackageName"], "[type]"=>[{"message"=>"The computer 'Administrator (built-in)' preference item in the 'Local Administrator Policy {7505FF97-CD2C-44B3-8667-8842768657BC}' Group Policy Object did not apply because it failed with error code '0x8007052a This operation is disallowed as it could result in an administration account being disabled, deleted or unable to logon.' This error was suppressed.", "@version"=>"1", "@timestamp"=>"2016-08-01T23:32:04.000Z", "record_number"=>"26709", "beat"=>{"name"=>"SETHER01", "hostname"=>"SETHER01"}, "log_name"=>"Application", "event_id"=>4098, "event_data"=>{"param2"=>"Administrator (built-in)", "param3"=>"Local Administrator Policy {7505FF97-CD2C-44B3-8667-8842768657BC}", "param4"=>"0x8007052a This operation is disallowed as it could result in an administration account being disabled, deleted or unable to logon.", "param1"=>"computer"}, "level"=>"Warning", "keywords"=>["Classic"], "user"=>{"identifier"=>"S-1-5-18", "name"=>"SYSTEM", "domain"=>"NT AUTHORITY", "type"=>"User"}, "tags"=>["support.local", "beats", "beats_input_codec_plain_applied", "_grokparsefailure"], "type"=>"wineventlog", "source_name"=>"Group Policy Local Users and Groups", "computer_name"=>"SETHER01.support.local", "host"=>"SETHER01"}, "type"]}>>], :response=>{"create"=>{"_index"=>"winlogbeat-2016.08.01", "_type"=>"wineventlog", "_id"=>"AVZVsbgER563NkM5Cr8L", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [event_data.param2]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"Administrator (built-in)\""}}}}, :level=>:warn}` So the error seems to be with the 'Administrator (built-in)' part of the message, is there anyway to "normalise" this? either at the client or ideally the logstash side ? I would assume this would affect any eventlog with ' ' written in it ? Any help is appreciated Thanks ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 4, 2016, 2:11pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/2 "2016-08-04T14:11:10Z")
What does the mapping for this index look like? Can you query elasticsearch to get the mapping for that index and attach the output here. Also can you check you Elasticsearch log to see if there are any more details in the log when this error occurs. Command to query the mapping: `curl http://:9200/winlogbeat-2016.08.01/_mapping?pretty` ---
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 4, 2016, 2:16pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/3 "2016-08-04T14:16:31Z")
Hi the mapping wont fit into the text box (its over 5000 characters) , is there any other way I can get this to you ? Thanks ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 4, 2016, 2:18pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/4 "2016-08-04T14:18:12Z")
How about dropping the data into [http://pastebin.com](http://pastebin.com) and sharing the link. Thanks ---
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 4, 2016, 2:25pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/5 "2016-08-04T14:25:30Z")
Here it is [http://pastebin.com/hbQk0APH](http://pastebin.com/hbQk0APH) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 4, 2016, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/6 "2016-08-04T14:56:32Z")
Did you install the index template for Winlogbeat? The index template should configure all of the `event_data.*` fields to be string types. It looks like the mapping for the field was detected as a date. This would occur if the first event with `event_data.param2` had a date value and the provided index template was not installed. ```auto "param2" : { "type" : "date", "format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis" }, ``` Reference: [Winlogbeat Reference [5.0] » Getting Started With Winlogbeat » Step 4: Loading the Index Template in Elasticsearch](https://www.elastic.co/guide/en/beats/winlogbeat/5.0/winlogbeat-template.html) ---
**Author:** ![rhyse](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Post date:** [August 4, 2016, 3:53pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/7 "2016-08-04T15:53:17Z")
Honestly cant remember, but don't think so. Have done that now . New mappings below [http://pastebin.com/diHUtczR](http://pastebin.com/diHUtczR) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 4, 2016, 3:54pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/8 "2016-08-04T15:54:46Z")
Great, that should fix the issue. 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2016, 3:55pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-mapper-parsing-exception-from-elasticsearch/57223/9 "2016-08-25T15:55:00Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.