diff --git a/winlogbeat/docs/fields.asciidoc b/winlogbeat/docs/fields.asciidoc index 74f7107b326..a8a370b15c0 100644 --- a/winlogbeat/docs/fields.asciidoc +++ b/winlogbeat/docs/fields.asciidoc @@ -114,7 +114,7 @@ type: dict required: False -The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log messages are unnamed in earlier versions of Windows. +The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. [float] diff --git a/winlogbeat/etc/fields.yml b/winlogbeat/etc/fields.yml index d3359f25aae..fa10dcfacf8 100644 --- a/winlogbeat/etc/fields.yml +++ b/winlogbeat/etc/fields.yml @@ -45,7 +45,7 @@ The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, - `param2`, and so on, because event log messages are unnamed in + `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. - name: event_id