{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/beats/pulls/comments/56132225","id":56132225,"diff_hunk":"@@ -164,6 +221,11 @@ eventlog:\n       description: >\n         The type of account associated with this event.\n \n+    - name: version\n+      type: int","path":"winlogbeat/etc/fields.yml","position":152,"original_position":152,"commit_id":"4fcf05dab68564df9df4b98906036e9889dcfbdb","original_commit_id":"4fcf05dab68564df9df4b98906036e9889dcfbdb","user":{"login":"ruflin","id":244900,"avatar_url":"https://avatars.githubusercontent.com/u/244900?v=3","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"body":"The type in elasticsearch seems to be \"integer\" an not \"int\": https://www.elastic.co/guide/en/elasticsearch/reference/current/number.html#number Not sure if both works. We use int also in all other `fields.yml` so we would have to change it everywhere.","created_at":"2016-03-15T09:04:23Z","updated_at":"2016-03-15T09:04:23Z","html_url":"https://github.com/elastic/beats/pull/1153#discussion_r56132225","pull_request_url":"https://api.github.com/repos/elastic/beats/pulls/1153","_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments/56132225"},"html":{"href":"https://github.com/elastic/beats/pull/1153#discussion_r56132225"},"pull_request":{"href":"https://api.github.com/repos/elastic/beats/pulls/1153"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/1153","id":62855160,"html_url":"https://github.com/elastic/beats/pull/1153","diff_url":"https://github.com/elastic/beats/pull/1153.diff","patch_url":"https://github.com/elastic/beats/pull/1153.patch","issue_url":"https://api.github.com/repos/elastic/beats/issues/1153","number":1153,"state":"open","locked":false,"title":"Winlogbeat - include structured event data with each event","user":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"body":"Implements #1053 \r\n\r\n#### Changes\r\n- Add additional data to the events published by Winlogbeat. The new fields are `activity_id`,\r\n`event_data`, `keywords`, `opcode`, `process_id`, `provider_guid`, `related_activity_id`,\r\n`task`, `thread_id`, `user_data`. and `version`. __Examples of the new events can be seen [here](https://gist.github.com/andrewkroh/c88950a56e0d0b4dcee1).__\r\n- The `message_inserts` field was replaced with the `event_data` field\r\n- The `category` field was renamed to `task` to better align with the Windows Event Log API naming\r\n\r\n#### Benefits\r\nThe benefit to this change is that Winlogbeat now provides the data from the event log message in a structured format. For example, for a user login event the text from the message may be\r\n\r\n```\r\nSubject:\r\n    Security ID:        S-1-5-21-3541430928-2051711210-1391384369-1001\r\n    Account Name:        vagrant\r\n    Account Domain:        VAGRANT-2012-R2\r\n    Logon ID:        0x837F2   \r\n```\r\n\r\nand to make use of this message most users would have previously used Logstash to grok the key/value data. Now, included in the JSON event is the same data in a structured format:\r\n\r\n```json\r\n  \"event_data\": {\r\n    \"LogonType\": \"8\",\r\n    \"TargetDomainName\": \"VAGRANT-2012-R2\",\r\n    \"TargetLogonId\": \"0x837f2\",\r\n    \"TargetUserName\": \"vagrant\",\r\n    \"TargetUserSid\": \"S-1-5-21-3541430928-2051711210-1391384369-1001\"\r\n  }\r\n```\r\n\r\n### What's Left to Do\r\n\r\n- Due to the refactoring which simplified how event data was retrieved from the Windows Event Log API, we lost the ability to render partial events when errors occur. I need to improve the code that interfaces to Windows so that it falls back to rendering the event without the message so that we get parts of the event without the `message`.","created_at":"2016-03-15T04:54:15Z","updated_at":"2016-03-15T09:04:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b967dd6e3de64386881d500f7c9340fcc84ba8e4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/elastic/beats/pulls/1153/commits","review_comments_url":"https://api.github.com/repos/elastic/beats/pulls/1153/comments","review_comment_url":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/beats/issues/1153/comments","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/4fcf05dab68564df9df4b98906036e9889dcfbdb","head":{"label":"andrewkroh:feature/wlb-structured-event-data","ref":"feature/wlb-structured-event-data","sha":"4fcf05dab68564df9df4b98906036e9889dcfbdb","user":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"repo":{"id":38412372,"name":"beats","full_name":"andrewkroh/beats","owner":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/andrewkroh/beats","description":"Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":true,"url":"https://api.github.com/repos/andrewkroh/beats","forks_url":"https://api.github.com/repos/andrewkroh/beats/forks","keys_url":"https://api.github.com/repos/andrewkroh/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/andrewkroh/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/andrewkroh/beats/teams","hooks_url":"https://api.github.com/repos/andrewkroh/beats/hooks","issue_events_url":"https://api.github.com/repos/andrewkroh/beats/issues/events{/number}","events_url":"https://api.github.com/repos/andrewkroh/beats/events","assignees_url":"https://api.github.com/repos/andrewkroh/beats/assignees{/user}","branches_url":"https://api.github.com/repos/andrewkroh/beats/branches{/branch}","tags_url":"https://api.github.com/repos/andrewkroh/beats/tags","blobs_url":"https://api.github.com/repos/andrewkroh/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/andrewkroh/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/andrewkroh/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/andrewkroh/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/andrewkroh/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/andrewkroh/beats/languages","stargazers_url":"https://api.github.com/repos/andrewkroh/beats/stargazers","contributors_url":"https://api.github.com/repos/andrewkroh/beats/contributors","subscribers_url":"https://api.github.com/repos/andrewkroh/beats/subscribers","subscription_url":"https://api.github.com/repos/andrewkroh/beats/subscription","commits_url":"https://api.github.com/repos/andrewkroh/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/andrewkroh/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/andrewkroh/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/andrewkroh/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/andrewkroh/beats/contents/{+path}","compare_url":"https://api.github.com/repos/andrewkroh/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/andrewkroh/beats/merges","archive_url":"https://api.github.com/repos/andrewkroh/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/andrewkroh/beats/downloads","issues_url":"https://api.github.com/repos/andrewkroh/beats/issues{/number}","pulls_url":"https://api.github.com/repos/andrewkroh/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/andrewkroh/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/andrewkroh/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/andrewkroh/beats/labels{/name}","releases_url":"https://api.github.com/repos/andrewkroh/beats/releases{/id}","deployments_url":"https://api.github.com/repos/andrewkroh/beats/deployments","created_at":"2015-07-02T05:03:11Z","updated_at":"2016-01-20T19:52:45Z","pushed_at":"2016-03-15T05:40:32Z","git_url":"git://github.com/andrewkroh/beats.git","ssh_url":"git@github.com:andrewkroh/beats.git","clone_url":"https://github.com/andrewkroh/beats.git","svn_url":"https://github.com/andrewkroh/beats","homepage":"https://www.elastic.co/products/beats","size":26354,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"9e92d0338313a3326557ff3515733f57d1e0cc59","user":{"login":"elastic","id":6764390,"avatar_url":"https://avatars.githubusercontent.com/u/6764390?v=3","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":16554739,"name":"beats","full_name":"elastic/beats","owner":{"login":"elastic","id":6764390,"avatar_url":"https://avatars.githubusercontent.com/u/6764390?v=3","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/elastic/beats","description":"Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":false,"url":"https://api.github.com/repos/elastic/beats","forks_url":"https://api.github.com/repos/elastic/beats/forks","keys_url":"https://api.github.com/repos/elastic/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/beats/teams","hooks_url":"https://api.github.com/repos/elastic/beats/hooks","issue_events_url":"https://api.github.com/repos/elastic/beats/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/beats/events","assignees_url":"https://api.github.com/repos/elastic/beats/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/beats/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/beats/tags","blobs_url":"https://api.github.com/repos/elastic/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/beats/languages","stargazers_url":"https://api.github.com/repos/elastic/beats/stargazers","contributors_url":"https://api.github.com/repos/elastic/beats/contributors","subscribers_url":"https://api.github.com/repos/elastic/beats/subscribers","subscription_url":"https://api.github.com/repos/elastic/beats/subscription","commits_url":"https://api.github.com/repos/elastic/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/beats/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/beats/merges","archive_url":"https://api.github.com/repos/elastic/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/beats/downloads","issues_url":"https://api.github.com/repos/elastic/beats/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/beats/labels{/name}","releases_url":"https://api.github.com/repos/elastic/beats/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/beats/deployments","created_at":"2014-02-05T19:01:02Z","updated_at":"2016-03-15T08:08:25Z","pushed_at":"2016-03-15T08:36:30Z","git_url":"git://github.com/elastic/beats.git","ssh_url":"git@github.com:elastic/beats.git","clone_url":"https://github.com/elastic/beats.git","svn_url":"https://github.com/elastic/beats","homepage":"https://www.elastic.co/products/beats","size":31202,"stargazers_count":2533,"watchers_count":2533,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":348,"mirror_url":null,"open_issues_count":212,"forks":348,"open_issues":212,"watchers":2533,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/1153"},"html":{"href":"https://github.com/elastic/beats/pull/1153"},"issue":{"href":"https://api.github.com/repos/elastic/beats/issues/1153"},"comments":{"href":"https://api.github.com/repos/elastic/beats/issues/1153/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/beats/pulls/1153/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/beats/pulls/1153/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/beats/statuses/4fcf05dab68564df9df4b98906036e9889dcfbdb"}}}}