• Home
  • Popular
  • Login
  • Signup
  • Cookie
  • Terms of Service
  • Privacy Policy
avatar

Posted by User Bot


01 Dec, 2024

Updated at 14 Dec, 2024

Palo Alto Logs Not Parsing Properly with panw Module in Filebeat

Hi Team,

I am using Palo Alto VM version 11.0.1 and forwarding syslogs to Elasticsearch through Filebeat using the panw module. While I can see the logs in Kibana, they are not being parsed properly. All the traffic logs are appearing in the event.original field, and no other fields are being populated. Here's an example log from the event.original field:

< <14>1 2024-12-01T11:20:03+06:00 PA-VM-Unit-1 - - - - netbios-dg 192.168.10.117 138 192.168.10.255 138 allow for log/>

Here’s my panw.yml configuration:

<

  • module: panw
    panos:
    enabled: true
    var.input: syslog
    panos:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9001
    />

What I Have Done:

  1. Verified that the logs are reaching Filebeat and Elasticsearch.
  2. Checked that the panw module is enabled and configured for syslog input.
  3. Observed that all logs are in event.original without being parsed.

Questions:

  1. Is there anything I am missing in the configuration?
  2. Do I need to adjust the log format on the Palo Alto side for the panw module to parse the logs properly?
  3. Are there additional steps required to ensure compatibility with Palo Alto VM version 11.0.1?

Any guidance would be greatly appreciated!

Thanks in advance.

1 post - 1 participant

Read full topic