# Parse error for Winlogbeat messages

**URL:** <https://community.graylog.org/t/parse-error-for-winlogbeat-messages/6816>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, winlogbeat\
**Created:** [September 12, 2018, 6:28pm UTC](https://community.graylog.org/t/parse-error-for-winlogbeat-messages/6816 "2018-09-12T18:28:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ccandreva](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ccandreva/32/1694_2.png) [@ccandreva](https://community.graylog.org/u/ccandreva)\
**Post date:** [September 12, 2018, 6:28pm UTC](https://community.graylog.org/t/parse-error-for-winlogbeat-messages/6816/1 "2018-09-12T18:28:10Z")

</div>

I am receiving parse errors for messages from Winlogbeat, usually for the field winlogbeat\_event\_data\_param2 . The full message is:

`2018-09-11T19:58:56.387-04:00 WARN [Messages] Failed to index message: index=&lt;graylog_226&gt; id=&lt;a3970e26-b61e-11e8-a5ec-847bebd607f5&gt; error=&lt;{"type":"mapper_parsing_exception","reason":"failed to parse [winlogbeat_event_data_param2]","caused_by":{"type":"illegal_argument_exception","reason":"Invalid format: \"Local\""}}&gt;`

I checked my mapping via curl and the api, and under properties I have:  
“winlogbeat\_event\_data\_param2” : {  
“type” : “keyword”  
},

There are a huge list of enties (1,005 entries in the exported data) for winlogbeat\_event\_data\* and I"m not sure how they were brought in. Are they correct, how can I verify them ? I tried to import the winlogbeat index format yesterday but receivced an error every time.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [September 13, 2018, 5:49am UTC](https://community.graylog.org/t/parse-error-for-winlogbeat-messages/6816/2 "2018-09-13T05:49:48Z")

</div>

As long as you do not have the need to that data, I would drop it. See what elastic writes for this field:

> **[Legacy Winlogbeat alias fields | Winlogbeat Reference \[master\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/master/exported-fields-eventlog.html)**

> **`event_data`**  
> type: object  
> required: False  
> The event-specific data. This field is mutually exclusive with `user_data` . If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1` , `param2` , and so on, because event log parameters are unnamed in earlier versions of Windows.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 27, 2018, 5:49am UTC](https://community.graylog.org/t/parse-error-for-winlogbeat-messages/6816/3 "2018-09-27T05:49:49Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.