# Wrong parsed field

**URL:** <https://discuss.elastic.co/t/wrong-parsed-field/186751>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 20, 2019, 7:42pm UTC](https://discuss.elastic.co/t/wrong-parsed-field/186751 "2019-06-20T19:42:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jan\_Kaspar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jan_kaspar/32/44443_2.png) [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\
**Post date:** [June 20, 2019, 7:42pm UTC](https://discuss.elastic.co/t/wrong-parsed-field/186751/1 "2019-06-20T19:42:03Z")

</div>

Hello,

i am using WinLogBeat 7.1.1 (but it do not work in previous version too) and there is wrong parsed field **winlog.event\_data.FailureReason**

```
   	t winlog.computer_name	SomeServer1
   	t winlog.event_data.AuthenticationPackageName	Negotiate
 	? **winlog.event_data.FailureReason %%2313**
   	t winlog.event_data.IpAddress	127.0.0.1
   	t winlog.event_data.IpPort	0
   	t winlog.event_data.KeyLength	0

```

Can you fix this please? For now I have written my own rule to parse this information.

Thanks

Jan

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 20, 2019, 8:28pm UTC](https://discuss.elastic.co/t/wrong-parsed-field/186751/2 "2019-06-20T20:28:24Z")

</div>

It's not that Winlogbeat is parsing the anything wrong. This is exactly what Windows provides callers of the API to receive events. We have an issue open to enhance Winlogbeat with the ability to enrich events with a conversion of these codes to strings. See [https://github.com/elastic/beats/issues/11539](https://github.com/elastic/beats/issues/11539).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2019, 8:30pm UTC](https://discuss.elastic.co/t/wrong-parsed-field/186751/3 "2019-07-18T20:30:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.