From a796553c7a11824dafb20128bd23b462ff926f4c Mon Sep 17 00:00:00 2001
From: LucasArona <LucasArona@users.noreply.github.com>
Date: Wed, 10 May 2017 23:23:53 +0200
Subject: [PATCH] Fallback to LevelRaw if Level is not in the RenderingInfo of
 the XML event (#4257)

If the Level is not in the RenderingInfo section of the event, fallback on the raw level. Applies to Windows Vista and above only.

https://discuss.elastic.co/t/event-fields-missing-if-renderinginfo-is-empty/84709

(cherry picked from commit c18adcec570558d9974f32f00d6a6e5d80f45f73)
---
 CHANGELOG.asciidoc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 696f6d57519..2c3d0c5be52 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -53,6 +53,7 @@ https://github.com/elastic/beats/compare/v5.5.0...master[Check the HEAD diff]
 *Packetbeat*
 
 *Winlogbeat*
+- Add the ability to use LevelRaw if Level isn't populated in the event XML. {pull}4257[4257]
 
 ==== Deprecated