# Winlogbeat parse CAPI2 Log

**URL:** <https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [August 27, 2021, 7:26am UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637 "2021-08-27T07:26:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcel\_Palme](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcel_palme/32/61178_2.png) [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\
**Post date:** [August 27, 2021, 7:26am UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637/1 "2021-08-27T07:26:33Z")

</div>

I check the capi2 log in windows. The transmission to Elastic also works partially. Only that not all fields are transferred. Specifically, I need the field under  
Userdata | certverifyCertificateChainPolicy | certificata | subjectname

maybe also other fields ... how can I transfer these fields to ELastic?

Mfg Marcel

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637/2 "2021-08-30T12:35:35Z")

</div>

Do you have a sample of the UserData value? If you temporarily add [`include_xml: true`](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_event_logs_include_xml) Winlogbeat will send the raw XML that includes the user data then we can try to figure out why it's not parsing the data into `winlog.user_data.*`. It does assume a certain key/value structure of the user data XML, but there may be a workaround.

---

<div class="post-metadata">

**Author:** ![Marcel\_Palme](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcel_palme/32/61178_2.png) [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\
**Post date:** [September 14, 2021, 11:20am UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637/3 "2021-09-14T11:20:27Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a41029773088fc369058423d9e46710105679735.png)  
ich benötige die werte unter certificate --\> subjectname

above is the screenshot which is generated in the server's event log ...  
I need the values ​​under certificate -\> subjectname  
where do I have to store include\_xml: true?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2021, 1:21pm UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637/4 "2021-10-12T13:21:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.