WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T12:49:00.610Z","agent":{"ephemeral_id":"03f0e780-e6f7-4f57-aba3-136d3309d30a","id":"dfc891f4-6232-4a7c-9ace-b1c918d618e9","name":"NVIPROCPRDSQL01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Logon","code":"18453","created":"2024-07-27T12:49:01.562Z","kind":"event","outcome":"success","provider":"MSSQL$PAYGSQL01"},"host":{"name":"NVIPROCPRDSQL01.prdnvi.starkint.com"},"log":{"level":"information"},"message":"Login succeeded for user 'prdnvi\\procprd-sqlagent'. Connection made using Integrated authentication. [CLIENT: <local mstarkine>]","organization":"stark","senderHost":"10.160.22.36","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NVIPROCPRDSQL01.prdnvi.starkint.com","event_data":{"Binary":"154800000A0000001A0000004E0056004900500052004F004300500052004400530051004C00300031005C005000410059004700530051004C00300031000000070000006D00610073007400650072000000","param1":"prdnvi\\procprd-sqlagent","param2":" [CLIENT: <local mstarkine>]"},"event_id":"18453","keywords":["Audit Success","Classic"],"provider_name":"MSSQL$PAYGSQL01","record_id":85152174,"task":"Logon","user":{"domain":"prdnvi","identifier":"S-1-5-21-855572474-1402847513-2951438033-32116","name":"procprd-sqlagent","type":"User"}}}
This is a syslog message from a product called mssql$paygsql01 by mssql$paygsql01. The following fields were extracted from the message:
action: Logon
fieldExtractorName: winlogbeat
messageType: 18453
senderHost: 10.160.22.36
sensitivity: normal
sourceInfo: unknown
streamName: mssql$paygsql01
tags: ['v8', 'eventId:18453', 'mssql$paygsql01', '18453']
vendorCode: 85152174