# Winlogbeat mapping to OCSF
**URL:** https://discuss.elastic.co/t/winlogbeat-mapping-to-ocsf/333605
**Category:** Beats
**Tags:** winlogbeat
**Created:** [May 16, 2023, 9:03pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-to-ocsf/333605 "2023-05-16T21:03:40Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Zachary\_Schmerber](https://discuss.elastic.co/u/Zachary_Schmerber)
#### Post date: [May 16, 2023, 9:03pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-to-ocsf/333605/1 "2023-05-16T21:03:40Z")
Hello, I am trying to find a way to remove the ECS mappings that defaults in winlogbeats and move to OCSF mapping. Anyone know where the logic for the ECS transformations lives or have a repo for winlogbeat that dose not contain ECS. Is there a switch to turn off ECS in winlogbeats?
The way I see it I can do this mapping 2 ways:
1. Send Json raw wineventlogs to logstash and map there.
2. Map the OCSF in winlogbeats and send transformed data into the pipeline.
I would prefer to use winlogbeats to do the transformations but do not know where to insert my logic.
Any help on this would be greatly appreciated.
One thing I do not want to do is map from ECS to OCSF as that is a waist of compute.
#elastic-stack:beats and #elastic-stack:logstash.
> **[Open Cybersecurity Schema Framework](https://github.com/ocsf)**
>
> Open Cybersecurity Schema Framework has 7 repositories available. Follow their code on GitHub.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 13, 2023, 9:04pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-to-ocsf/333605/2 "2023-06-13T21:04:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.