# Winlogbeat windows server event issue

**URL:** <https://discuss.elastic.co/t/winlogbeat-windows-server-event-issue/362561>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 4, 2024, 2:11pm UTC](https://discuss.elastic.co/t/winlogbeat-windows-server-event-issue/362561 "2024-07-04T14:11:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![spazzrabbit](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\
**Post date:** [July 4, 2024, 2:11pm UTC](https://discuss.elastic.co/t/winlogbeat-windows-server-event-issue/362561/1 "2024-07-04T14:11:23Z")

</div>

Hello everyone !

I'm having weird issue with winlogbeat.  
When I use winlogbeat on Windows 10, after I create a windows user it uses fields such as "process.name", "process.parent.args" etc.  
But when I create a user on Windows Server 2019 it never uses these field. Also I don't even receive any "process create/terminate event"  
Unfortunately I can't use Detection Rules since these fields does not exists.  
Any one knows why ?

Some of the fields that windows 10 has while server 2019 doesn't.  
 ![resim](https://us1.discourse-cdn.com/elastic/original/3X/d/d/dd77c6cf905e89012c88365d824719665586c67b.png)