Filtering out Windows Event IDs

[toddehb]

Hi,

our DCs Eventlogs, including "Security", are shipped to SO. I want to filter for a specific username that is triggering e.g. Windows EventID 4771. In Kibana I can use this:

host.hostname: "company-dc01" and winlog.channel: "Security" and event.code:"4771"

to get all security events from a specific Domain controller (company-dc01). But how to I proceed further? .I don't see the username in the details tab.
Would appriciate any help. Thanks.

[toddehb]

Ok, under "messages" are the details, but how to filter for "username" within "messages"?

[toddehb]

I finally found the "user.name" Sorry for bothering. It's close to weekend ;-)