# Elastic Stack QRadar Integration

**URL:** <https://discuss.elastic.co/t/elastic-stack-qradar-integration/210247>\
**Category:** Logstash\
**Created:** [December 2, 2019, 9:15pm UTC](https://discuss.elastic.co/t/elastic-stack-qradar-integration/210247 "2019-12-02T21:15:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Booooooo](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Booooooo](https://discuss.elastic.co/u/Booooooo)\
**Post date:** [December 2, 2019, 9:15pm UTC](https://discuss.elastic.co/t/elastic-stack-qradar-integration/210247/1 "2019-12-02T21:15:48Z")

</div>

Hi,

So I have been playing with forwarding events from QRadar to the Elastic Stack. I have configured QRadar to forward events to Logstash via TCP in JSON format.

On Logstash I have...

**Input:**

```
input {
   tcp {
       port => 5141
       codec => "json_lines"
       }
}

```

**Filter:**

```
filter {
  if [type] in ["Event", "Flow"] {
     mutate {
        remove_field => ["name", "version", "isoTimeFormat"]
        rename => { "type" => "offense_type" }
     }
     mutate {
        replace => { "type" => "qradar_json" }
     }
     date {
        match => ["start_time", "ISO8601"]
        target => "@timestamp"
     }
   }
}

```

**Output:**

```
output {
   stdout { codec => rubydebug }
   elasticsearch {
      hosts => "localhost:9200"
      index => "qradar-%{+YYYY.MM.dd}"
   }
}

```

When starting Logstash with this configuration I get the following errors:

`[nioEventLoopGroup-2-1] jsonlines - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')`

When looking into the event itself I see:

`"message" => "<01>- hostname {\"name\":\"Elastic Data\",\"version\":\"1.0\",\"isoTimeFormat\":\"yyyy-MM-dd'T'HH:mm:ss.SSSZ\",\"type\":\"Event\",\"category\":\"APISuccess\",\"protocolID\":\"255\",\"sev\":\"3\",\...`

So it seems the problem is at " **\<01\>**" (if I'm reading this correctly) beginning of the message. In Elasticsearch none of the key/value pairs are being extracted into fields but are all in the message field.

Could anyone advise as to how I could fix this? Should I attempt to remove the problematic characters with the filter? Could the codec on the input be the problem?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 3, 2019, 1:03pm UTC](https://discuss.elastic.co/t/elastic-stack-qradar-integration/210247/2 "2019-12-03T13:03:25Z")

</div>

It looks like whatever is sending the message is using a syslog format. You cannot use a codec to parse it. You could use dissect, or mutate+gsub to strip the initial part of the message, then use a json filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2019, 1:03pm UTC](https://discuss.elastic.co/t/elastic-stack-qradar-integration/210247/3 "2019-12-31T13:03:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.