# Winlogbeat reports wrong event\_id on Windows Server 2003

**URL:** <https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 21, 2016, 11:43am UTC](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982 "2016-03-21T11:43:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\
**Post date:** [March 21, 2016, 11:43am UTC](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982/1 "2016-03-21T11:43:41Z")

</div>

Hi everyone,

I run winlogbeat 1.1 on windows server 2003 sp2 32bit OS, and configure winlogbeat.yml as follows:

```auto
  event_logs:
    - name: Application
      ignore_older: 3h 
    - name: Security
      ignore_older: 3h 
    - name: System
      ignore_older: 3h 

output:
  file:
    path: "c:"
    filename: winlogbeat

```

but the result has a wrong field, the correct event\_id is 3019, but it generates: `"event_id": 2147486667`.

I'm not sure is that a bug for winlogbeat, anyone encountered the same issue? And how can get the correct event\_id? thank you so much.

```auto
{"@timestamp":"2016-03-21T10:40:48.000Z","beat":{"hostname":"SERVER01","name":"SERVER01"},"category":"0","computer_name":"SERVER01","count":1,"event_id":2147486667,"level":"Warning","log_name":"System","message":"The redirector failed to determine the connection type.","record_number":"114274","source_name":"MRxSmb","type":"eventlogging"}

{"@timestamp":"2016-03-21T10:43:15.000Z","beat":{"hostname":"SERVER01","name":"SERVER01"},"category":"0","computer_name":"SERVER01","count":1,"event_id":2147486667,"level":"Warning","log_name":"System","message":"The redirector failed to determine the connection type.","record_number":"114275","source_name":"MRxSmb","type":"eventlogging"}

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 21, 2016, 12:57pm UTC](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982/2 "2016-03-21T12:57:46Z")

</div>

This issue has been fixed in the master branch, but not released yet. If you [download the development build](https://beats-nightlies.s3.amazonaws.com/winlogbeat/winlogbeat-5.0.0-nightlylatest-windows-32.zip) of [v5](https://www.elastic.co/v5) this should be fixed.

This issue was caused by the fact that the event ID is reported as unsigned 32-bit integer in pre-Vista Windows versions, but the upper 16-bits are not part of the event ID so they need to be masked from the value. This is the [change](https://github.com/elastic/beats/commit/074fa5d6bba44a91bc4c736decad8fabc32e91f9#diff-0979af172dbee9052e0e4c6322fc2292R117) that fixed the problem.

---

<div class="post-metadata">

**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\
**Post date:** [March 22, 2016, 6:22am UTC](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982/3 "2016-03-22T06:22:14Z")

</div>

Great! thank you so much , the wrong "event\_id" value has been fixed in the development version,I got the expected result. also hope the new version will come out soon.😁

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 12, 2016, 1:47pm UTC](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982/4 "2016-04-12T13:47:27Z")

</div>