Change Winlogbeat Field Names

(Robert Smith) #1


I have been using NXLog for shipping Windows events, but I’d like to switch over to Winlogbeat. My problem is that Winlogbeat ships all event fields with a “winlogbeat_” prefix for the name. I already have many dashboards and extractors setup using the field name without the Winlogbeat prefix. Is there are way to change this behavior?

Thank you!

(Jochen) #2

You could create a pipeline rule to rename the relevant message fields using the rename_field() function.

(Robert Smith) #3

Hi jochen!

Thank you for the suggestion! I’m still pretty new to Graylog and haven’t messed around with pipelines yet. Would I need to make a rule for every individual field name or could I make a rule to remove all “winlogbeat_” prefixes?

(Jochen) #4

You would need to create a rule renaming the relevant fields individually.

(Jan Doberstein) #5

Hej @rob.smith

you might want to sneak into this blog article that gives you a good example for the renaming of winlogbeat fields.

(Robert Smith) #6

Thank you both! I’ll check out pipelines and see how it goes.