WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T01:48:27.996Z","agent":{"ephemeral_id":"1a816226-5520-4d19-9f0a-910bd50c2191","id":"c6a28f12-5e1b-489b-b0d6-dae12936f03e","name":"TS02-2016","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"4098","created":"2024-07-27T01:48:28.090Z","kind":"event","provider":"Group Policy Printers"},"host":{"name":"TS02-2016.umbrella.com"},"log":{"level":"warning"},"message":"The user 'Norcross Warranty MD2852' preference item in the 'Users-Location Norcross {E9E36FDD-77B3-4342-B695-8A8551D22E0E}' Group Policy Object did not apply because it failed with error code '0x80070709 The printer name is invalid.' This error was suppressed.","organization":"umbrella","senderHost":"NORDC-SXESTAGE0.umbrella.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"TS02-2016.umbrella.com","event_data":{"param1":"user","param2":"Norcross Warranty MD2852","param3":"Users-Location Norcross {E9E36FDD-77B3-4342-B695-8A8551D22E0E}","param4":"0x80070709 The printer name is invalid."},"event_id":"4098","keywords":["Classic"],"provider_name":"Group Policy Printers","record_id":91522,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
This is a syslog message from a product called group policy printers by group policy printers. The following fields were extracted from the message:
fieldExtractorName: winlogbeat
messageType: 4098
senderHost: NORDC-SXESTAGE0.mingledorffs.com
sensitivity: normal
sourceInfo: unknown
streamName: group policy printers
tags: ['v8', 'eventId:4098', 'group policy printers', '4098']
vendorCode: 91522