On Fri, May 12, 2017 at 11:55:51AM -0400, Scot wrote: > I take that back. Getting data in the winlogbeat target but the json is > not getting parsed. All coming in as a messages block. At this point, providing the full config would help. As for my point about UTC, just trust me, you want that.