2
responses
responses
Take for example event 4624, with output as JSON to kafka, there is a JSON field in im_msvistalog
:
"Category":"Logon",
...
"Task":12544,
Now, looking at an event 4624 collected via im_wseventing
, the JSON looks like this:
"Task":"Logon"
Note: Field Category is missing! As "Task" contains the category, in reality, the Task is missing here..
Please fix that for the WEC collector.
Best regards Theo
Comments (1)
Hi Rafal,
Thank's for your response. I don't think that I can further split up the topic as the two fields mentioned here are both involved in this specific problem. In one config, the field content is put into "Category", in the other the same content is put into "Task". => How should I split up the topic in different questions? The question is: Why is the content moved from "Category" to "Task" if I change from OSLogs to WEC receiving?
attached is a config anonymized and a bit shortened for WEC:
Ah, and regards to the version: We currently use v4.8.4811 enterprise and plan to ugprade to v5.1.6133 but there were some other problems involved here which we are currently in contact with you so that we can hopefully upgrade to v5 soon.