Get rid of explanation in windows message log

Question

I am wondering if it is possible to get rid (or simply not store in the first place) the "explanation" inside the events with a specific id, as e.g., event of class 4624 (win2008).

Although the question is generic, I include my particular use case as reference:

I send the logs through winlogbeat to an elasticsearch node, which stores in the field "message" also the explanation. Although it is possible to configure winlogbeat ignore the explanation (through a regexp) I would like to know if there is the possibility in the first place to not send the explanation, e.g., through a configuration in the windows OS.

Answer 1

The description you are talking about is not stored by Windows but rendered when you read the events.

However:

If you are forwarding Windows Events with Windows Event Forwarding, you can configure the system to render the events before transferring them.

In your case, it seems that you installed Winlogbeat on the server on which you want to collect events, and Winlogbeat can render the events before transferring them. You should be able to disable this behavior by setting eventlog.forwarded to true.