WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T05:32:31.672Z","agent":{"ephemeral_id":"47434381-3d10-4395-bc1c-5cdb52ecb35e","id":"12e13a9a-252a-493f-9c35-fa4d61abd0bc","name":"NORDC-DC-01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"General","code":"103","created":"2024-07-27T05:32:32.318Z","kind":"event","provider":"ESENT"},"host":{"name":"NORDC-DC-01.oscorp.com"},"log":{"level":"information"},"message":"DFSRs (4200,T,97) \\\\.\\C:\\System Volume Information\\DFSR\\database_7E1C_5C53_1C5C_913\\dfsr.db: The database engine stopped the instance (0). \n \nDirty Shutdown: 0 \n \nInternal Timing Sequence: \n[1] 0.000005 +J(0)\n[2] 0.000005 +J(0)\n[3] 0.000005 +J(0)\n[4] 0.000003 +J(0)\n[5] 0.048446 -0.034743 (5) WT +J(0) +M(C:0K, Fs:4, WS:0K # 0K, PF:0K # 0K, P:0K)\n[6] 0.000019 +J(0)\n[7] 0.000008 +J(0)\n[8] 0.066758 -0.039322 (11) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:4096/2) +M(C:0K, Fs:8, WS:-24K # 0K, PF:-28K # 0K, P:-28K)\n[9] 0.001982 -0.000989 (1) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:66/1) +M(C:0K, Fs:2, WS:8K # 0K, PF:0K # 0K, P:0K)\n[10] 0.000021 +J(0)\n[11] 0.006872 -0.002410 (2) WT +J(0)\n[12] 0.000033 +J(0) +M(C:0K, Fs:0, WS:-4K # 0K, PF:-4K # 0K, P:-4K)\n[13] 0.000770 +J(0)\n[14] 0.000034 +J(0) +M(C:0K, Fs:0, WS:-20K # 0K, PF:-32K # 0K, P:-32K)\n[15] 0.000003 +J(0).","organization":"oscorp","senderHost":"NORDC-DC-01.oscorp.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-DC-01.oscorp.com","event_data":{"param1":"DFSRs","param2":"4200,T,97","param3":"\\\\.\\C:\\System Volume Information\\DFSR\\database_7E1C_5C53_1C5C_913\\dfsr.db: ","param4":"0","param5":"\n[1] 0.000005 +J(0)\n[2] 0.000005 +J(0)\n[3] 0.000005 +J(0)\n[4] 0.000003 +J(0)\n[5] 0.048446 -0.034743 (5) WT +J(0) +M(C:0K, Fs:4, WS:0K # 0K, PF:0K # 0K, P:0K)\n[6] 0.000019 +J(0)\n[7] 0.000008 +J(0)\n[8] 0.066758 -0.039322 (11) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:4096/2) +M(C:0K, Fs:8, WS:-24K # 0K, PF:-28K # 0K, P:-28K)\n[9] 0.001982 -0.000989 (1) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:66/1) +M(C:0K, Fs:2, WS:8K # 0K, PF:0K # 0K, P:0K)\n[10] 0.000021 +J(0)\n[11] 0.006872 -0.002410 (2) WT +J(0)\n[12] 0.000033 +J(0) +M(C:0K, Fs:0, WS:-4K # 0K, PF:-4K # 0K, P:-4K)\n[13] 0.000770 +J(0)\n[14] 0.000034 +J(0) +M(C:0K, Fs:0, WS:-20K # 0K, PF:-32K # 0K, P:-32K)\n[15] 0.000003 +J(0).","param6":"0"},"event_id":"103","keywords":["Classic"],"opcode":"Info","provider_name":"ESENT","record_id":614375,"task":"General"}}
This is a syslog message from a product called esent by esent. The following fields were extracted from the message:
action: General
fieldExtractorName: winlogbeat
messageType: 103
senderHost: NORDC-DC-01.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: esent
tags: ['v8', 'eventId:103', 'esent', '103']
vendorCode: 614375