6503_winlogbeat_autoruns.conf

filter {
  if "autorunstowin" in [tags] {
    kv { 
      prefix => "[event_data]"
      remove_char_key => "\ "
      transform_key => "lowercase"
      field_split => "\n"
      value_split => ":"
    }
    mutate {
      replace => { "type" => "autoruns" }
    }
    mutate {
      rename => { "[beat][hostname]" => "hostname" }
      rename => { "[event_data][category]" => "category" }
      rename => { "[event_data][company]" => "company" }
      rename => { "[event_data][entry]" => "entry" }
      rename => { "[event_data][entrylocation]" => "entry_location" }
      rename => { "[event_data][imagepath]" => "image_path" }
      rename => { "[event_data][launchstring]" => "launch_string" }
      rename => { "[event_data][profile]" => "profile" }
      rename => { "[event_data][signer]" => "signer" }
    }
  }
}