# Winlogbeat event\_id **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [June 5, 2017, 2:29am UTC](https://discuss.elastic.co/t/winlogbeat-event-id/88209 "2017-06-05T02:29:36Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Post date:** [June 5, 2017, 2:29am UTC](https://discuss.elastic.co/t/winlogbeat-event-id/88209/1 "2017-06-05T02:29:36Z")
Hi there, Is there a way to include meaningful descriptions to each of the event\_ids that are being ingested into logstash? When I use the event\_id to display top five for example I get the actual Event ID from Windows 4,634 4,648 4,768 4,625 4,740 I would like it to expand it to display something like 4740 account locked 4625 failed to logon and so on Thanks ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 5, 2017, 1:51pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id/88209/2 "2017-06-05T13:51:28Z")
You could use Logstash to add your own custom category to events. With the [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html#plugins-filters-translate-dictionary) filter you can map event IDs to categories and add this a a new field, like `category`. ---
**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Post date:** [June 5, 2017, 11:54pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id/88209/3 "2017-06-05T23:54:22Z")
Thanks for the suggestion Andrew, that does look like what I'm after ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2017, 11:54pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id/88209/4 "2017-07-03T23:54:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.