# Azure NSG Integration help

**URL:** <https://discuss.elastic.co/t/azure-nsg-integration-help/256342>\
**Category:** Logstash\
**Created:** [November 23, 2020, 10:15am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342 "2020-11-23T10:15:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\
**Post date:** [November 23, 2020, 10:15am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342/1 "2020-11-23T10:15:44Z")

</div>

Hi,  
I am trying to integrate Azure NSG Logs into Elastic, I have done 80% but there is 1 field is proving a little difficult for me and it has all the important flow information.  
Each log event contaains 5 flows information it currently under a single field so I would like to split each of them in there own event and then dissect to extract the flow information, each tuple begins with datetime, srcip, dstip, srcport,dstport,etc  
but first i need to somehow seperate them

 ![NSG](https://us1.discourse-cdn.com/elastic/original/3X/4/1/41da8b6af18c5608364615d70e5ec06a075e2985.png)

---

<div class="post-metadata">

**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\
**Post date:** [November 23, 2020, 10:19am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342/2 "2020-11-23T10:19:45Z")

</div>

My current logstash configuration looks like this which of course isn't correct

```auto
input {
  pipeline { address => intel }
}

filter {
  split {
field => "[records]"
  }
  split {
field => "[records][properties][flows]"
  }
  split {
field => "[records][properties][flows][flows]"
  }
# dissect {
# mapping => {
# "[records][properties][flows][flows][flowTuples]" => '%{time},%{srcaddr},%{dstaddr},%{srcport},%{dstport},%{protocol},%{direction},%{action},%{state},%{srcpackets},%{srcbytes},{dstpackets},%{dstbytes}'
# }
# }
  mutate {
    split => { "[records][resourceId]" => "/"}
    add_field => {
           "Subscriptions" => "%{[records][resourceId][2]}"
           "ResourceGroup" => "%{[records][resourceId][4]}"
           "NetworkSecurityGroup" => "%{[records][resourceId][8]}"
            }
    convert => {"Subscriptions" => "string"}
    convert => {"ResourceGroup" => "string"}
    convert => {"NetworkSecurityGroup" => "string"}
    split => { "[records][properties][flows][flows][flowTuples]" => ","}
    add_field => {
           "unixtimestamp" => "%{[records][properties][flows][flows][flowTuples][0]}"
           "srcIp" => "%{[records][properties][flows][flows][flowTuples][1]}"
           "destIp" => "%{[records][properties][flows][flows][flowTuples][2]}"
           "srcPort" => "%{[records][properties][flows][flows][flowTuples][3]}"
           "destPort" => "%{[records][properties][flows][flows][flowTuples][4]}"
           "protocol" => "%{[records][properties][flows][flows][flowTuples][5]}"
           "trafficflow" => "%{[records][properties][flows][flows][flowTuples][6]}"
           "traffic" => "%{[records][properties][flows][flows][flowTuples][7]}"
            }
    convert => {"unixtimestamp" => "integer"}
  }
  date{
  match => ["unixtimestamp", "UNIX"]
  }
}

output {

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2020, 10:19am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342/3 "2020-12-21T10:19:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.