WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T14:06:55.099Z","agent":{"ephemeral_id":"970ead45-d705-467a-802a-cd059c8f9fbb","id":"1e289ed9-fa81-478d-9ec3-98d5119c9f2e","name":"TS01-2016","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"255","created":"2024-07-26T14:06:56.012Z","kind":"event","provider":"Nutanix Guest Agent"},"host":{"name":"TS01-2016.umbrella.com"},"log":{"level":"information"},"message":"Waiting for 30 minutes before starting Nutanix Guest Agent Service...","organization":"umbrella","senderHost":"TS01-2016.umbrella.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"TS01-2016.umbrella.com","event_data":{"param1":"Waiting for 30 minutes before starting Nutanix Guest Agent Service..."},"event_id":"255","keywords":["Classic"],"provider_name":"Nutanix Guest Agent","record_id":151588,"task":"None"}}
This is a syslog message from a product called nutanix guest agent by nutanix guest agent. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 255
senderHost: TS01-2016.mingledorffs.com
sensitivity: normal
sourceInfo: unknown
streamName: nutanix guest agent
tags: ['v8', 'eventId:255', 'nutanix guest agent', '255']
vendorCode: 151588