# Winlogbeat and Windows Event Fowarder (WEF) Wrong Hostname

**URL:** <https://discuss.elastic.co/t/winlogbeat-and-windows-event-fowarder-wef-wrong-hostname/218808>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 11, 2020, 3:54pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-fowarder-wef-wrong-hostname/218808 "2020-02-11T15:54:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SeekAndDestroy](https://avatars.discourse-cdn.com/v4/letter/s/2acd7d/32.png) [@SeekAndDestroy](https://discuss.elastic.co/u/SeekAndDestroy)\
**Post date:** [February 11, 2020, 3:54pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-fowarder-wef-wrong-hostname/218808/1 "2020-02-11T15:54:00Z")

</div>

Hi. Last year, I configured Windows Event Forwarding to send 6 Windows Domain Controllers their Security Logs to a centralized server. The server has WinlogBeat reading the forwarded events, and sending them to Elasticsearch (On the same machine).

The host information being indexed only shows the Centralized log server, not that of the actual DC where the event was pushed from. The correct host is contained in the Winlog.event\_data. Is this normal? If not, what do I need to do to fix it?

My Winlogbeat.yml is very basic:

> winlogbeat.event\_logs:  
> - name: ForwardedEvents  
> - name: Application

Thanks,  
J

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 18, 2020, 2:43pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-fowarder-wef-wrong-hostname/218808/2 "2020-02-18T14:43:29Z")

</div>

The latest version of Winlogbeat uses the event log's computer\_name value in the `host.name` field. Try the latest release.

- [https://github.com/elastic/beats/pull/14625](https://github.com/elastic/beats/pull/14625)
- [https://github.com/elastic/beats/issues/13706](https://github.com/elastic/beats/issues/13706)

---

<div class="post-metadata">

**Author:** ![SeekAndDestroy](https://avatars.discourse-cdn.com/v4/letter/s/2acd7d/32.png) [@SeekAndDestroy](https://discuss.elastic.co/u/SeekAndDestroy)\
**Post date:** [February 18, 2020, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-fowarder-wef-wrong-hostname/218808/3 "2020-02-18T14:56:15Z")

</div>

Thank you, that worked!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2020, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-fowarder-wef-wrong-hostname/218808/4 "2020-03-17T14:56:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.