# Winlogbeat 7.9 removed a field? **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [September 22, 2020, 10:11pm UTC](https://discuss.elastic.co/t/winlogbeat-7-9-removed-a-field/249588 "2020-09-22T22:11:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ted1621](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ted1621/32/63595_2.png) [@ted1621](https://discuss.elastic.co/u/ted1621)\ **Post date:** [September 22, 2020, 10:11pm UTC](https://discuss.elastic.co/t/winlogbeat-7-9-removed-a-field/249588/1 "2020-09-22T22:11:32Z")
I just completed upgrading my winlogbeat versions to 7.9.1. As part of this upgrade it now appears that my winlogbeat agent is no longer parsing this particular event type? ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/e/ce6e032596ea7d5a431ff3d8966481ce8fcbf4fd.png) This event type is part a sysmon job that is tied to the Mitre Attack Framework and is part of our monitoring dashboard. Any thoughts on how to get this back without reverting to a lower version? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 22, 2020, 11:11pm UTC](https://discuss.elastic.co/t/winlogbeat-7-9-removed-a-field/249588/2 "2020-09-22T23:11:33Z")
Since v7.8.0 it's been using the ECS `rule.name` field for this data. > > **[Rule Fields | Elastic Common Schema (ECS) Reference \[1.6\] | Elastic](https://www.elastic.co/guide/en/ecs/current/ecs-rule.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 21, 2020, 1:11am UTC](https://discuss.elastic.co/t/winlogbeat-7-9-removed-a-field/249588/3 "2020-10-21T01:11:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.