# Winlogbeat missing mapping fields **URL:** \ **Category:** Beats\ **Tags:** filebeat, packetbeat, metricbeat, winlogbeat\ **Created:** [October 21, 2020, 1:48pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846 "2020-10-21T13:48:32Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 21, 2020, 1:48pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/1 "2020-10-21T13:48:33Z")
Hi, I have just installed Winlogbeat on one of my Windows 2019 terminal servers. After configurion the .yml file I have entered setup commands: > winlogbeat.exe setup --index-management > winlogbeat.exe setup --dahsboards The template was created and dashboards were added. After inspecting the dashboards I noticed the following thing. ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/f/df3dbb73039e95592522dc97268b9364d62ac693.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d9836ac0488f4af05714cf5ebfd16d7e0f51b88.png) I have checked the index template mapping and I do not have any mappings for this field. I have met with this error a lot of times during the last few months. I did not change the configuration regarding the index template, index pattern in beats .yml I have not idea what I am doing wrong so my mapping set up from beasts have missing fields. I have a similar issue with 7.7 filebeat cisco module, 7.8 metricbeat system module, as well as I, have with [filebeat 7.9.2 netflow module](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/2) ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 21, 2020, 3:14pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/2 "2020-10-21T15:14:05Z")
Hi Adriann, Do you already have data in the winlogbeat index? If so, if you update the Index Pattern does it solve the error? Regards Anna ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 10:54am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/3 "2020-10-22T10:54:50Z")
Hi Anna, I do have now. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/8572e4027b6af13b461e6b96f6f72077e48b70b8.png) But the fields did not dynamically add. I just want to understand If the error in dashboards results from fields that are no longer used or it's something else? ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 10:57am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/4 "2020-10-22T10:57:25Z")
This is even weirder. It's like It's present but it's not? I don't get It. ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/d/9dd792677edf5e91c044b48166e57ade244c7c27.png) ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 22, 2020, 12:35pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/5 "2020-10-22T12:35:46Z")
Hi Adriann, Did you refresh your Kibana index patterns? I do not know the powershell dashboard but I do know the other one (User Management Events) because i was the one I did it. Regarding to winlog.logon.id is a very useful field because it allows you to correlate different events performed by the same user, if it is not in the index pattern is dynamically generated (when you receive an event with that field) . From winlogbeat's Index Template: ``` { "strings_as_keyword": { "match_mapping_type": "string", "mapping": { "ignore_above": 1024, "type": "keyword" } } } ``` In summary, if you have an index with winlog.logon.id field present and then you refresh your index pattern in kibana, the error in the user managment event dashboard should disappear Please let me know if that helps you Regards Anna ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 2:04pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/6 "2020-10-22T14:04:57Z")
> [@Anabella\_Cristaldi](#): > > efresh your Kibana index patterns? Thanks for your input. I did refresh the indices and I saw some change in field numbers. But still, see the same error. Does this just must mean that kibana has never seen a document with that field? ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 22, 2020, 2:30pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/7 "2020-10-22T14:30:37Z")
What do you see in the discovery tab when wyou search for the winlog.logon.id? ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/255c4a90f1d48af2fdef97e3d03acbbdda3e1379.png) What do you see if you go to Index Patterns -\> winlogbeat and search for this field? ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/789c36a819f084876cb4a54ba5632f05c81a1b6b.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77f6737e9ae2236fcc94bcdc29926d893e27889e.png) Thank you! ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 2:59pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/8 "2020-10-22T14:59:39Z")
I see this. My agent version is 7.9.2 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed8b4c8d8d1208b75a05097cc97425b427c5c5ab.png) ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 22, 2020, 3:12pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/9 "2020-10-22T15:12:05Z")
And still appears this error? ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2c036281b405cd8e3935c9dc3e953e9fbaf9fa6.png) ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 3:33pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/10 "2020-10-22T15:33:55Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/4465e5f2de2b4ecfce627bc44c37414320a73839.png) It looks better but still not perfect. Can and should I set up auto index refresh? ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 22, 2020, 3:39pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/11 "2020-10-22T15:39:27Z")
Hi Adriann, It is not related to index refresh, but index pattern. How does the User Management Event dashboard looks like? Thank you ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 3:43pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/12 "2020-10-22T15:43:04Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67d53242819f3d67616637e8d9ee6a84d32c8667.png) ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 22, 2020, 3:51pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/13 "2020-10-22T15:51:51Z")
I'll try to reproduce your scenario Regards ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 22, 2020, 4:19pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/14 "2020-10-22T16:19:51Z")
I started with a clean space. No index pattern, no dashboards and it works OK for me ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b3a4ed0bf80036f89f1b17951f79c0e45ae0d90.png) ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 22, 2020, 7:55pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/15 "2020-10-22T19:55:41Z")
I refreshed the index once again and now its better. Now I only miss this field. In this dashboard. ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/01f92a875acd956c6703d7e0b1345ab36bac4a0e.png) Can you explain why It works like this? ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 23, 2020, 8:37am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/16 "2020-10-23T08:37:23Z")
Hi Adriann, I did some extra test with a clean environment and here the explanation: when you first execute`winlogbeat setup --index-management` a winlogbeat index is created based on winlogbeat's index template. In that index pattern _there is no definition_ for `winlog.logon.id` nor `winlog.event_data.OldTargetUserName`. That's why when you enter the first time to the dashboards the error appears. Once you have real data containing values for `winlog.logon.id` and `winlog.event_data.OldTargetUserName` and you refresh the Kibana's index pattern the error will disappear. Just to check, just rename a user in windows, so event 4781 is generated, refresh your index pattern and ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef4587fe3e967a7cd85b6d4b5ff27f507354447e.png) should disappear. Regards Ana PS1: I've also realize that the newer version of the dashboards are not in this version. I do not why ([https://github.com/elastic/beats/pull/18775](https://github.com/elastic/beats/pull/18775)) PS2: When new users (modeling multiple users in an event) fields will be incorporated to ECS ([https://github.com/elastic/ecs/pull/914#issuecomment-671584201](https://github.com/elastic/ecs/pull/914#issuecomment-671584201)) I'll use those fields for dashboards ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 23, 2020, 8:53am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/17 "2020-10-23T08:53:56Z")
I asked my friend to add a local user and change his name. The output shows some field but even after refreshing the index pattern this is the dashboard look. ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f9db1360be36c58718012d102a7b84383c9c4ccb.png) ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 23, 2020, 9:00am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/18 "2020-10-23T09:00:41Z")
Please close the browser and open the dashboard again. Regards ---
**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Post date:** [October 23, 2020, 9:03am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/19 "2020-10-23T09:03:44Z")
Yes, now I can see everything. Thank you very much for your help in resolving this as well as helping me understanding how It works 🙂 \<3 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 20, 2020, 11:03am UTC](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/20 "2020-11-20T11:03:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.