Custom UDP with PANW integration

Elastic Stack Elastic Agent
1

Hello,
I used PANOS integration that work great for me. Now I want to change my configuration and use Custom UDP Logs integration. In advanced options I changed Ingest pipelines "logs-udp.generic@custom".

image
image1146×661 42.2 KB

I also tested pipeline adding the document that was indexed by Custom UDP Logs integration, and it worked. But unfortunately when I saved this, I cannot find my logs. Could you confirm me, how can I added integration to custom udp integration. Is adding a custom pipeline enough?

2

Hi @Patryk_Ostrowski Can you show us the configuration as well?

Screenshot 2023-10-02 at 7.54.22 AM
Screenshot 2023-10-02 at 7.54.22 AM2398×1538 280 KB

If you did not change anything else I would expect the logs to end up in the data stream

logs-udp.generic-default

3

Thanks, It's working, but I cannot find my logs because I had a problem with time. Logs were putting to future date. But could you explain me what is difference between Ingest Pipeline field in Custom UDP Settings and Ingest piplines (in advanced options) with editing logs-udp.generic@custom ?

4

Yes is is a bit of an overlap... here is how I see it.

The one in the Ingest Pipeline field is for that specific UDP integration,

The logs-udp.generic@custom is one that would get applied at the end for Every UDP integration.
At least that is how I think of it.... like a "final" pipeline.

5

Thanks for your anserw

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.