Wrong details parsing - Windows event-log

Hello friends,
In some alerts Elastic shows the full log but in others i get for example not the user name but the user SID (not as the eventViewer log).
Suggestions to fix?
Uploaded a picture.