# AD Parsing **URL:** \ **Category:** Logstash\ **Created:** [August 24, 2017, 8:20am UTC](https://discuss.elastic.co/t/ad-parsing/98176 "2017-08-24T08:20:23Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rajath](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rajath](https://discuss.elastic.co/u/rajath)\ **Post date:** [August 24, 2017, 8:20am UTC](https://discuss.elastic.co/t/ad-parsing/98176/1 "2017-08-24T08:20:24Z")
We are trying to parse Checkpoint logs but as there are multiple types of log formats. Depending on the blades we are running on Checkpoint the key value changes. if anyone has a conf file for checkpoint please share. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 24, 2017, 8:04pm UTC](https://discuss.elastic.co/t/ad-parsing/98176/2 "2017-08-24T20:04:05Z")
You'll probably get better help if you provide more details. Chances are there won't be any folks with detailed knowledge of Checkpoint logs. ---
**Author:** ![rajath](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rajath](https://discuss.elastic.co/u/rajath)\ **Post date:** [August 25, 2017, 4:19am UTC](https://discuss.elastic.co/t/ad-parsing/98176/3 "2017-08-25T04:19:29Z")
Hi Magnus, We have managed to write grok for different type of logs from CheckPoint Firewall. Thank you for your input. ---
**Author:** ![Kicker83](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kicker83/32/121202_2.png) [@Kicker83](https://discuss.elastic.co/u/Kicker83)\ **Post date:** [September 5, 2017, 6:59am UTC](https://discuss.elastic.co/t/ad-parsing/98176/4 "2017-09-05T06:59:11Z")
Hi rajath, Do you have a github with the log parsing? I'm very interested on it. Here is my github with my configs. There are configs for network elements (bluecoat, juniper srx, juniper netscreen, squid, and palo alto). > **[kicker83/ELK-Networking](https://github.com/kicker83/ELK-Networking)** > > ELK-Networking - Repository with logstash, elasticsearch and kibana configs. Palo Alto, Juniper, BlueCoat, etc. Thanks in advance! Regards ---
**Author:** ![Kicker83](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kicker83/32/121202_2.png) [@Kicker83](https://discuss.elastic.co/u/Kicker83)\ **Post date:** [September 5, 2017, 8:02am UTC](https://discuss.elastic.co/t/ad-parsing/98176/5 "2017-09-05T08:02:49Z")
Hi rajath, Finally we used grok + KV to parse fields. If you are interested, you can check it in my github. Regards! ---
**Author:** ![rajath](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rajath](https://discuss.elastic.co/u/rajath)\ **Post date:** [September 21, 2017, 8:43am UTC](https://discuss.elastic.co/t/ad-parsing/98176/6 "2017-09-21T08:43:34Z")
Hi Santiago, Do you have AD parser by any chance? We cannot use wineventlog beat due to internal policies. ---
**Author:** ![Kicker83](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kicker83/32/121202_2.png) [@Kicker83](https://discuss.elastic.co/u/Kicker83)\ **Post date:** [September 21, 2017, 9:00am UTC](https://discuss.elastic.co/t/ad-parsing/98176/7 "2017-09-21T09:00:16Z")
Hi Rajath! Sorry, but I only have parses for network devices. Regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 19, 2017, 9:00am UTC](https://discuss.elastic.co/t/ad-parsing/98176/8 "2017-10-19T09:00:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.