Hello, I have installed winlogbeat on my Windows server, and it works fine, I have all data. Unfortunately, I would like to have the count of user logon and logoff and there arent' the data corresponding. All informations are stored on the field "message": Is there a way to parse the "message" f…

@matthieurobin , @dloyd , An update on this... Winlogbeat has been enhanced to report this data as a field so you will no longer need to grok the message. You can try the feature by using the development build . It will be released with v5 . Screenshot here: Reporting Windows Security Events in Kibana

Discuss the Elastic Stack

Winlogbeat and User sessions (parsing fields from message)

Elastic Stack Beats

andrewkroh (Andrew Kroh) March 8, 2016, 11:14pm 8

@dloyd, If you query the enriched documents directly from Elasticsearch using curl or Sense, do you see the added fields?

Topic		Replies	Views
Windows event message field Beats winlogbeat	1	340	July 19, 2021
Filter event from Winlogbeat Logstash	6	752	September 6, 2018
Windows Event Viewer Logs Parsing without Winlogbeat Logstash	2	924	September 9, 2020
Reporting Windows Security Events in Kibana Beats winlogbeat	4	5464	April 12, 2016
Fields not populated Beats winlogbeat	4	989	August 7, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Winlogbeat and User sessions (parsing fields from message)

Related topics