<xs:element name="Version"
type="unsignedByte"
/>{
"@metadata": {
"beat": "winlogbeat",
"type": "_doc",
"version": "8.0.0"
},
"@timestamp": "0001-01-01T00:00:00.000Z",
"agent": {
"ephemeral_id": "df2506e7-02ed-483d-ad29-71ce21c33568",
"hostname": "vagrant",
"id": "29845c4d-9a56-426f-b12f-7c930602301b",
"type": "winlogbeat",
"version": "8.0.0"
},
"ecs": {
"version": "1.4.0"
},
"error": {
"message": "strconv.ParseUint: parsing \"101.3\": invalid syntax"
},
"event": {
"code": 4656,
"created": "2020-01-24T20:31:06.581Z",
"kind": "event",
"original": "<Event xmlns='http://schemas.netapp.com/events/event'><System><Provider Name='NetApp-Security-Auditing' Guid='{3CB2A168-FE19-4A4E-BDAD-DCF422F13473}'/><EventID>4656</EventID><EventName>Open Object</EventName><Version>101.3</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime='2019-03-26T23:27:07.015494000Z'/><Correlation/><Channel>Security</Channel><Computer>anvil/vs-anvil</Computer><ComputerUUID>b5552ea8-5ae2-11e6-b524-00a098a5d936/91f499cd-5cfe-11e6-b525-00a098a5d936</ComputerUUID><Security/></System><EventData><Data Name='SubjectIP' IPVersion='4'>192.168.1.2</Data><Data Name='SubjectHostname' Source=''></Data><Data Name='SubjectUnix' Uid='65534' Gid='65534' Local='false'/><Data Name='SubjectUserSid'>S-1-5-21-2770437333-1905433116-4256127273-1282</Data><Data Name='SubjectUserIsLocal'>false</Data><Data Name='SubjectDomainName'>DOMAIN</Data><Data Name='SubjectUserName'>john.doe</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>File</Data><Data Name='HandleID'>00000000000000;00;00000000;00000000</Data><Data Name='ObjectName'>(workshop_fg);/path/09.jpg</Data><Data Name='AccessList'>%%4416 %%4417 %%4418 %%4419 %%4420 %%4423 %%4424 %%1538 </Data><Data Name='AccessMask'>8607</Data><Data Name='DesiredAccess'>Read Data; List Directory; Write Data; Add File; Append Data; Add Subdirectory; Read Extended Attributes; Write Extended Attributes; Read Attributes; Write Attributes; Read ACL; </Data><Data Name='Attributes'>Set Attributes; Create; Open a non-directory; </Data></EventData></Event>",
"provider": "NetApp-Security-Auditing"
},
"host": {
"name": "vagrant"
},
"log": {
"file": {
"path": "C:\\vagrant\\winlogbeat\\sys\\wineventlog\\testdata\\netapp-example.evtx"
},
"level": "information"
},
"winlog": {
"api": "wineventlog",
"channel": "",
"event_id": 4656,
"provider_guid": "{3CB2A168-FE19-4A4E-BDAD-DCF422F13473}",
"provider_name": "NetApp-Security-Auditing",
"record_id": 0,
"task": ""
}
}
The XML schema for Windows event logs defines the
Versionas anunsignedByte(reference). It contains the version number of the event's definition.Events containing
Versionvalues that are not uint8 will cause the XML parser to return an error. This results in an event from Winlogbeat with anerror.messagean not much usable data.I propose we make the parsing of
Versionmore lenient and simply drop values that are non in the uint8 range. We cannot change the type ofwinlog.version, which islongin Elasticsearch, without a breaking change.