Docs
  • Release notes
  • Troubleshoot
  • Reference
  • Elastic fundamentals
  • Solutions and use cases
  • Manage data
  • Explore and analyze
  • Deploy and manage
  • Manage your Cloud account and preferences
  • Troubleshoot
  • Release notes
  • Reference
  • Extend and contribute
  • Contribute to the docs
  • Elasticsearch
    • Configuration
    • JVM settings
    • Built-in roles
    • Elasticsearch privileges
    • Index settings
    • Index lifecycle actions
    • REST APIs
    • Mapping
    • Elasticsearch audit events
    • Command-line tools
    • Text analysis components
    • Aggregations
    • Processor reference
    • Curator
    • Clients
    • Elasticsearch plugins
    • Scripting languages
  • Kibana
    • Accessibility
    • Configuration
    • Advanced settings
    • Kibana audit events
    • Connectors
    • Kibana plugins
    • Command line tools
    • Osquery exported fields
    • Osquery Manager prebuilt packs
    • Case analytics indices schema
  • Cloud
    • Elastic Cloud Enterprise
    • Elastic Cloud Hosted
    • Elastic Cloud on Kubernetes
    • Elastic cloud control (ECCTL)
  • Security
    • Fields and object schemas
    • Endpoint command reference
    • Elastic Defend advanced settings
    • Prebuilt detection rules reference
  • Observability
    • Fields and object schemas
    • Infrastructure metrics reference
  • Ingestion tools
    • APM
    • Beats
    • Content connectors
    • Elastic Distributions of OpenTelemetry (EDOT)
    • Elastic integrations
    • Elastic Serverless Forwarder for AWS
    • Elasticsearch for Apache Hadoop
    • Fleet and Elastic Agent
    • Logstash
    • Logstash Plugins
    • Logstash Versioned Plugin Reference
  • Query languages
    • QueryDSL
    • ES|QL
    • SQL
    • EQL
    • Kibana Query Language
  • Elastic Common Schema (ECS)
    • Using ECS
    • ECS field reference
    • ECS categorization fields
    • Migrating to ECS
    • ECS & OpenTelemetry
    • Additional information
    • ECS logging libraries
  • Machine learning
    • Kibana anomaly detection job wizards
    • ML function reference
  • Search UI
    • Ecommerce
    • Tutorials
    • Basic usage
    • Advanced usage
    • API reference
    • Troubleshooting
  • Glossary
  • View as Markdown
  • Report a docs issue
  • Edit this page
  • Learn how to contribute
Loading
  1. Elastic Docs /
  2. Reference /
  3. Ingestion tools /
  4. Beats /
  5. Winlogbeat

Exported fields

Stack

This document describes the fields that are exported by Winlogbeat. They are grouped in the following categories:

  • Beat fields
  • Cloud provider metadata fields
  • Docker fields
  • ECS fields
  • Legacy Winlogbeat alias fields
  • Host fields
  • Jolokia Discovery autodiscover provider fields
  • Kubernetes fields
  • PowerShell module fields
  • Process fields
  • Security module fields
  • Sysmon module fields
  • Winlogbeat fields
Previous
Sysmon Module
Next
Beat fields
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2025 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.