- Winlogbeat Reference: other versions:
- Overview
- Getting Started With Winlogbeat
- Setting up and running Winlogbeat
- Upgrading Winlogbeat
- Configuring Winlogbeat
- Set up Winlogbeat
- Specify general settings
- Configure the internal queue
- Configure the output
- Configure index lifecycle management
- Specify SSL settings
- Filter and Enhance the exported data
- Define processors
- Add cloud metadata
- Add fields
- Add labels
- Add the local time zone
- Add tags
- Decode JSON fields
- Drop events
- Drop fields from events
- Keep fields from events
- Rename fields from events
- Add Kubernetes metadata
- Add Docker metadata
- Add Host metadata
- Dissect strings
- DNS Reverse Lookup
- Add process metadata
- Parse data by using ingest node
- Enrich events with geoIP information
- Configure project paths
- Configure the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- HTTP Endpoint
- winlogbeat.reference.yml
- Exported fields
- Monitoring Winlogbeat
- Securing Winlogbeat
- Troubleshooting
- Contributing to Beats
Event log record fields
editEvent log record fields
editContains data from a Windows event log record.
-
type -
type: alias
alias to: winlog.api
-
activity_id -
type: alias
alias to: winlog.activity_id
-
computer_name -
type: alias
alias to: winlog.computer_name
-
event_id -
type: alias
alias to: winlog.event_id
-
keywords -
type: alias
alias to: winlog.keywords
-
log_name -
type: alias
alias to: winlog.channel
-
message_error -
type: alias
alias to: error.message
-
record_number -
type: alias
alias to: winlog.record_id
-
related_activity_id -
type: alias
alias to: winlog.related_activity_id
-
opcode -
type: alias
alias to: winlog.opcode
-
provider_guid -
type: alias
alias to: winlog.provider_guid
-
process_id -
type: alias
alias to: winlog.process.pid
-
source_name -
type: alias
alias to: winlog.provider_name
-
task -
type: alias
alias to: winlog.task
-
thread_id -
type: alias
alias to: winlog.process.thread.id
-
user.identifier -
type: alias
alias to: winlog.user.identifier
-
user.domain -
type: alias
alias to: winlog.user.domain
-
user.type -
type: alias
alias to: winlog.user.type
-
version -
type: alias
alias to: winlog.version
-
xml -
type: alias
alias to: event.original