Palo Alto Logs Not Parsing Properly with panw Module in Filebeat

Hi Team,

I am using Palo Alto VM version 11.0.1 and forwarding syslogs to Elasticsearch through Filebeat using the panw module. While I can see the logs in Kibana, they are not being parsed properly. All the traffic logs are appearing in the event.original field, and no other fields are being populated. Here's an example log from the event.original field:

< <14>1 2024-12-01T11:20:03+06:00 PA-VM-Unit-1 - - - - netbios-dg 192.168.10.117 138 192.168.10.255 138 allow for log/>

Here’s my panw.yml configuration:

<

• module: panw
  panos:
  enabled: true
  var.input: syslog
  panos:
  var.syslog_host: 0.0.0.0
  var.syslog_port: 9001
  />

What I Have Done:

1. Verified that the logs are reaching Filebeat and Elasticsearch.
2. Checked that the panw module is enabled and configured for syslog input.
3. Observed that all logs are in event.original without being parsed.

Questions:

1. Is there anything I am missing in the configuration?
2. Do I need to adjust the log format on the Palo Alto side for the panw module to parse the logs properly?
3. Are there additional steps required to ensure compatibility with Palo Alto VM version 11.0.1?

Any guidance would be greatly appreciated!

Thanks in advance.

1 post - 1 participant

Read full topic