I just completed upgrading my winlogbeat versions to 7.9.1. As part of this upgrade it now appears that my winlogbeat agent is no longer parsing this particular event type? [image] This event type is part a sysmon job that is tied to the Mitre Attack Framework and is part of our monitoring dashb…

Winlogbeat 7.9 removed a field?

system (system) Closed October 21, 2020, 1:11am 3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Windows event fields parsing Logstash	3	476	July 30, 2019
Winlogbeat Original Field remove Beats winlogbeat	1	329	August 12, 2021
Winlogbeat 7.15.1 with sysmon missing fields task and message on Windows Server 2022 Beats winlogbeat	10	1617	December 29, 2021
Winlogbeat and ECS Beats winlogbeat	8	2174	October 30, 2018
Pulling details of an event entry with Winlogbeat Beats winlogbeat	6	2291	April 12, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Winlogbeat 7.9 removed a field?

Related topics