# Winlogbeat - Sysmon Module and Even.Code: 1 Missing **URL:** \ **Category:** Beats\ **Tags:** beats-module, winlogbeat\ **Created:** [September 30, 2021, 5:40pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-module-and-even-code-1-missing/285620 "2021-09-30T17:40:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![elasticband](https://avatars.discourse-cdn.com/v4/letter/e/977dab/32.png) [@elasticband](https://discuss.elastic.co/u/elasticband)\ **Post date:** [September 30, 2021, 5:40pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-module-and-even-code-1-missing/285620/1 "2021-09-30T17:40:53Z")
I am having a problem with Winlogbeats not sending or not properly parsing all the Sysmon event.code fields. I have been testing beign able to event code: 1 for process creations like "whoami.exe", but when I started to look I did not see any event code=1 being sent. I can look in the Event viewer and see them listed, but for some reason I do not see it in Kibana. I am not dropping any event codes on any server, but some workstations I am I am dropping event.code: 2 AND 3.... Any ideas on why that is? Event Log: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/6/86e20cf95f57516b5ebfea4bc60e279224111aa2.png) Detailed Event Log: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2ffed9fd6717deeadf5a1c80e066500ea24c4e6f.png) Graph in Kibana: (7 days) ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50f8a2a1086dc57c51da5a2dc1a6dbc57a150b66.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 28, 2021, 7:41pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-module-and-even-code-1-missing/285620/2 "2021-10-28T19:41:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.