WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T18:01:18.561Z","agent":{"ephemeral_id":"560ff567-a3d5-4557-8b6c-45687da4c8d6","id":"76eb9f91-c210-4b95-9288-5a2c5f4e1a67","name":"MicroixWeb01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"1704","created":"2024-07-26T18:01:19.106Z","kind":"event","provider":"SceCli"},"host":{"name":"MicroixWeb01.DMZ.local"},"log":{"level":"information"},"message":"Security policy in the Group policy objects has been applied successfully.","organization":"wayne","senderHost":"10.0.0.75","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"MicroixWeb01.DMZ.local","event_id":"1704","keywords":["Classic"],"provider_name":"SceCli","record_id":39203,"task":"None"}}
This is a syslog message from a product called scecli by scecli. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 1704
senderHost: 10.0.0.75
sensitivity: normal
sourceInfo: unknown
streamName: scecli
tags: ['v8', 'eventId:1704', 'scecli', '1704']
vendorCode: 39203