winlogbeat issue with field names from windows defender
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
Windows Defender generates events with field names that contain spaces. Spaces in field names are problematic for indexing with Winlogbeat, causing messages like the following to appear:
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Trigger Index for message ae5313b0-0b2d-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Trigger for message ae5313b0-0b2d-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Type Index for message ae5313b0-0b2d-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Time Seconds for message 0690f382-0b2e-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Product Name for message 0690f382-0b2e-11f1-aa9d-dea415d79e2c
Ignoring invalid or reserved key winlogbeat_winlog_event_data_Scan Time Hours for message 0690f382-0b2e-11f1-aa9d-dea415d79e2c
Root Cause:
Field names containing spaces are treated as invalid or reserved, causing the logs to be partially ignored or not indexed properly.
how can i configure winlogbeat to get the field names correctly without spaces? I want to change the " " Space to "_" to get it work.
Contributor guide
Assessment
This issue has not been assessed yet.