Winlogbeat data is not parsing properly

Elastic Stack Beats
1

Hi Team,

I'm using winlogbeat for pushing all windows events to elasticsearch. Parsing is not happening properly.

  1. One of the examples is under “Message” there is “Properties” which when parsed in winlog.event_data.Properties does not show up correctly

Actual message :-1

message
message1152×648 13.1 KB

parsed field :-1

parsed_event
parsed_event1152×648 26.8 KB

It should come read property but coming some number %%7684

Is it bug?

Thanks
Sundar

2

Can you provide the raw XML from the Windows Event Viewer for this particular event. Winlogbeat does not parse the message field. It unmarshals the event it gets from Windows in XML and sends it as JSON.

The conversion of %%7684 to "Read Property" is possibly something that could be handled in a module, like the Security module.

3

@andrewkroh, Your right . I have checked my XML and it coming as %%7682. It looks like issue from our windows event. Thanks a lot for your reply. We can close this thread.

4

What was the event ID? It's probably something we can enrich in the Security module. Like do a conversion in the winlog.event_data field.

5

event id is 4662. Below are screenshots. Not only 4662 and other security events also.

General view :-

message_4662
message_46621152×648 71.2 KB

XML view :-
winlog_event_4662
winlog_event_46621152×648 145 KB

I'm not sure why properties field is different from general view and XML view. Our windows team also looking into this. will get back to you soon once i get the update from windows team.

6

Event ID 4662 isn't yet handled in the Security module. The module does have a translation table for those codes. The module needs enhanced to map the fields in 4662 over to ECS.

7

Thanks for your information, Can you please let me know how many events are completed with ECS format for all fields and what are the other event ID's are pending for ECS? if we get details we can parse the data via logstash. No need to wait for another release for this.

8

This information about what event IDs are mapped in each module is contained in the documentation. Choose your Winlogbeat version in the docs. Additionally the source for each module is in Github and you can see the mapping logic.

9

thank you for detailed information.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.