elastic / elastic/beats

winlogbeat issue with field names from windows defender

Open
#48,876 1 comment 0 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

Windows Defender generates events with field names that contain spaces. Spaces in field names are problematic for indexing with Winlogbeat, causing messages like the following to appear:

Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Trigger Index for message ae5313b0-0b2d-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Trigger for message ae5313b0-0b2d-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Type Index for message ae5313b0-0b2d-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Time Seconds for message 0690f382-0b2e-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Product Name for message 0690f382-0b2e-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Time Hours for message 0690f382-0b2e-11f1-aa9d-dea415d79e2c

Root Cause:

Field names containing spaces are treated as invalid or reserved, causing the logs to be partially ignored or not indexed properly.

how can i configure winlogbeat to get the field names correctly without spaces? I want to change the " " Space to "_" to get it work.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.