# Winlogbeat missing winlog.event\_data.IpAddress

**URL:** <https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 29, 2020, 8:24pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745 "2020-10-29T20:24:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [October 29, 2020, 8:24pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745/1 "2020-10-29T20:24:22Z")

</div>

Hi,  
I have a windows machine with Active Directory and winlogbeat (7.3) and in the generated info i have a field `winlog.event_data.IpAddress` but on a differente scenario with winlogbeat (7.4.2) that field is not present.

Does anyone know if that is some configuration on windows to make windows event to include that information, or it is a problem on winlogbeat configuration? I guess that is not a winlogbeat version problem as the oldest version includes the field.

thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 30, 2020, 6:41pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745/2 "2020-10-30T18:41:23Z")

</div>

The [security module](https://www.elastic.co/guide/en/beats/winlogbeat/7.x/winlogbeat-module-security.html) renames that field to `source.ip` for authentication events to follow [ECS](https://www.elastic.co/guide/en/ecs/current/ecs-source.html#ecs-source).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2020, 8:41pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745/3 "2020-11-27T20:41:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.