# Winlogbeat does not resolve SIDs of forwarded Event-Logs

**URL:** <https://discuss.elastic.co/t/winlogbeat-does-not-resolve-sids-of-forwarded-event-logs/83752>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 26, 2017, 7:01pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-resolve-sids-of-forwarded-event-logs/83752 "2017-04-26T19:01:38Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 26, 2017, 7:15pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-resolve-sids-of-forwarded-event-logs/83752/2 "2017-04-26T19:15:11Z")

</div>

This came up once in the past and we discussed adding a processor to lookup the SIDs in the event with the AD. The first step would be figure what features are needed in the processor and open an enhancement ticket.

See the topic at [Winlogbeat displaying GUID in Windows events instead of object name](https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442/5?u=andrewkroh)

---

_[View the full topic](https://discuss.elastic.co/t/winlogbeat-does-not-resolve-sids-of-forwarded-event-logs/83752)._