WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T05:20:12.950Z","agent":{"ephemeral_id":"aa96b357-d517-4faf-8466-4a84e56f29d7","id":"c5c7734b-f1c1-4011-84fa-15db81eba6a8","name":"NORDC-SS1-APID","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Web Event","code":"1305","created":"2024-07-27T05:20:13.328Z","kind":"event","provider":"ASP.NET 4.0.30319.0"},"host":{"name":"NORDC-SS1-APID.wayne.com"},"log":{"level":"information"},"message":"Event code: 1003 \nEvent message: Application compilation is starting. \nEvent time: 7/27/2024 1:20:12 AM \nEvent time (UTC): 7/27/2024 5:20:12 AM \nEvent ID: f27d94cf1664442296d749341b221cb2 \nEvent sequence: 6194 \nEvent occurrence: 2 \nEvent detail code: 0 \n \nApplication information: \n    Application domain: /LM/W3SVC/1/ROOT-1-133665264005082092 \n    Trust level: Full \n    Application Virtual Path: / \n    Application Path: D:\\Website\\ \n    Mwayneine name: NORDC-SS1-APID \n \nProcess information: \n    Process ID: 11640 \n    Process name: w3wp.exe \n    Account name: MDS-ATL\\svc.insiteweb \n \nCustom event details: ","organization":"wayne","senderHost":"10.20.30.114","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-SS1-APID.wayne.com","event_data":{"param1":"1003","param10":"Full","param11":"/","param12":"D:\\Website\\","param13":"NORDC-SS1-APID","param15":"11640","param16":"w3wp.exe","param17":"MDS-ATL\\svc.insiteweb","param2":"Application compilation is starting.","param3":"7/27/2024 1:20:12 AM","param4":"7/27/2024 5:20:12 AM","param5":"f27d94cf1664442296d749341b221cb2","param6":"6194","param7":"2","param8":"0","param9":"/LM/W3SVC/1/ROOT-1-133665264005082092"},"event_id":"1305","keywords":["Classic"],"opcode":"Info","provider_name":"ASP.NET 4.0.30319.0","record_id":48295,"task":"Web Event"}}
{
    "action": "Web Event",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-27T05:20:12.950Z\",\"agent\":{\"ephemeral_id\":\"aa96b357-d517-4faf-8466-4a84e56f29d7\",\"id\":\"c5c7734b-f1c1-4011-84fa-15db81eba6a8\",\"name\":\"NORDC-SS1-APID\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Web Event\",\"code\":\"1305\",\"created\":\"2024-07-27T05:20:13.328Z\",\"kind\":\"event\",\"provider\":\"ASP.NET 4.0.30319.0\"},\"host\":{\"name\":\"NORDC-SS1-APID.wayne.com\"},\"log\":{\"level\":\"information\"},\"message\":\"Event code: 1003 \\nEvent message: Application compilation is starting. \\nEvent time: 7/27/2024 1:20:12 AM \\nEvent time (UTC): 7/27/2024 5:20:12 AM \\nEvent ID: f27d94cf1664442296d749341b221cb2 \\nEvent sequence: 6194 \\nEvent occurrence: 2 \\nEvent detail code: 0 \\n \\nApplication information: \\n    Application domain: /LM/W3SVC/1/ROOT-1-133665264005082092 \\n    Trust level: Full \\n    Application Virtual Path: / \\n    Application Path: D:\\\\Website\\\\ \\n    Mwayneine name: NORDC-SS1-APID \\n \\nProcess information: \\n    Process ID: 11640 \\n    Process name: w3wp.exe \\n    Account name: MDS-ATL\\\\svc.insiteweb \\n \\nCustom event details: \",\"organization\":\"wayne\",\"senderHost\":\"10.20.30.114\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-SS1-APID.wayne.com\",\"event_data\":{\"param1\":\"1003\",\"param10\":\"Full\",\"param11\":\"/\",\"param12\":\"D:\\\\Website\\\\\",\"param13\":\"NORDC-SS1-APID\",\"param15\":\"11640\",\"param16\":\"w3wp.exe\",\"param17\":\"MDS-ATL\\\\svc.insiteweb\",\"param2\":\"Application compilation is starting.\",\"param3\":\"7/27/2024 1:20:12 AM\",\"param4\":\"7/27/2024 5:20:12 AM\",\"param5\":\"f27d94cf1664442296d749341b221cb2\",\"param6\":\"6194\",\"param7\":\"2\",\"param8\":\"0\",\"param9\":\"/LM/W3SVC/1/ROOT-1-133665264005082092\"},\"event_id\":\"1305\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_name\":\"ASP.NET 4.0.30319.0\",\"record_id\":48295,\"task\":\"Web Event\"}}",
    "messageType": "1305",
    "senderHost": "10.20.30.114",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "asp.net 4.0.30319.0",
    "tags": [
        "v8",
        "eventId:1305",
        "asp.net 4.0.30319.0",
        "1305"
    ],
    "vendorCode": "48295"
}