# WInlogbeat - event\_data Default SD String:

**URL:** <https://discuss.elastic.co/t/winlogbeat-event-data-default-sd-string/210766>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 5, 2019, 6:30pm UTC](https://discuss.elastic.co/t/winlogbeat-event-data-default-sd-string/210766 "2019-12-05T18:30:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Post date:** [December 5, 2019, 6:30pm UTC](https://discuss.elastic.co/t/winlogbeat-event-data-default-sd-string/210766/1 "2019-12-05T18:30:57Z")

</div>

Winlogbeat 7.4.0 is occasionally producing this:  
"date\_partition": {  
"day": "05",  
"month": "12",  
"year": "2019"  
},  
"@version": "1",  
"log": {  
"level": "information"  
},  
"winlog": {  
"computer\_name": "Server2106.acme.local",  
"api": "wineventlog",  
"activity\_id": "{519A1A6E-AAF4-0000-871A-9A51F4AAD501}",  
"provider\_name": "Microsoft-Windows-Directory-Services-SAM",  
"user": {  
"identifier": "S-1-5-18",  
"domain": "NT AUTHORITY",  
"name": "SYSTEM",  
"type": "User"  
},  
"task": "",  
"process": {  
"pid": 580,  
"thread": {  
"id": 584  
}  
},  
"event\_data": {  
"Default SD String:": "O:SYG:SYD:(A;;RC;;;BA)"  
},  
.....  
Notice the event\_data field. It appears to be identifying "Default SD String" as a field with a corresponding value. This seems incorrect because 1) "Default SD String" is not a valid ECS field and 2) it has spaces in it. This is causing me problems on the elastic side.

Does any one have any ideas, solutions?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2020, 6:31pm UTC](https://discuss.elastic.co/t/winlogbeat-event-data-default-sd-string/210766/2 "2020-01-02T18:31:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.