Winlogbeat missing winlog.event_data.IpAddress

Elastic Stack Beats
1

Hi,
I have a windows machine with Active Directory and winlogbeat (7.3) and in the generated info i have a field winlog.event_data.IpAddress but on a differente scenario with winlogbeat (7.4.2) that field is not present.

Does anyone know if that is some configuration on windows to make windows event to include that information, or it is a problem on winlogbeat configuration? I guess that is not a winlogbeat version problem as the oldest version includes the field.

thanks

2

The security module renames that field to source.ip for authentication events to follow ECS.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.