WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-30T14:34:30.375Z","agent":{"ephemeral_id":"a668c636-ec70-4103-9c98-53517f0df854","id":"040c78f0-1741-4108-a30c-aaf00e9af961","name":"NVIPROCPRDWEB01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"1000","created":"2024-07-30T14:34:31.269Z","kind":"event","provider":".NET Runtime"},"host":{"name":"NVIPROCPRDWEB01.prdnvi.starkint.com"},"log":{"level":"warning"},"message":"Category: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager\nEventId: 59\n\nNeither user profile nor HKLM registry available. Using an ephemeral key repository. Protected data will be unavailable when application exits.","organization":"stark","senderHost":"10.160.18.44","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NVIPROCPRDWEB01.prdnvi.starkint.com","event_data":{"param1":"Category: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager\nEventId: 59\n\nNeither user profile nor HKLM registry available. Using an ephemeral key repository. Protected data will be unavailable when application exits."},"event_id":"1000","keywords":["Classic"],"opcode":"Info","provider_name":".NET Runtime","record_id":1477809,"task":"None"}}
This is a syslog message from a product called .net runtime by .net runtime. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 1000
senderHost: 10.160.18.44
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: .net runtime
tags: ['v8', 'eventId:1000', '.net runtime', '1000']
vendorCode: 1477809