Are you using winlogbeats as a log shipper on your windows machines? That extracts a lot of information before sending to the beats input… It’s not clear about how you are working with the message, are you suing extractors, are you working in the pipeline? Here are some tips on how to make your question clearer here and here.
tmacgbay
(Tmacgbay)
2
Related topics
| Topic | Replies | Views | Activity | |
|---|---|---|---|---|
| Help with extractors | 12 | 3095 | January 25, 2019 | |
| Please help me parse this message | 3 | 2459 | February 2, 2021 | |
| GROK Extractor: how to match exact text and assign it to a field at the same time? | 2 | 990 | September 10, 2019 | |
| grok Pattern for Event ID 4663 not working extractor | 8 | 1919 | September 6, 2021 | |
| GROK pattern match fails | 4 | 1374 | November 6, 2019 |