# Field and Value missmatch Paolo Alto OS11 paring Logstash \> Elastic \> Kibana **URL:** \ **Category:** Logstash\ **Created:** [November 13, 2023, 9:15am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969 "2023-11-13T09:15:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Trung\_Nguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trung_nguyen/32/127478_2.png) [@Trung\_Nguyen](https://discuss.elastic.co/u/Trung_Nguyen)\ **Post date:** [November 13, 2023, 9:15am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/1 "2023-11-13T09:15:54Z")
Hi, i'm a new logstash and trying to parsing log from my firewall PAN\_OS 11 but the field and value dose not match, such as field "NAT Destination IP" get value from the "Rule Name" ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be08b3d4462a3d387f664c61b07344852382bcb6.png) Thanks a lot for any hlep Trung ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [November 13, 2023, 9:22am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/2 "2023-11-13T09:22:15Z")
Hello, You should start to read the following [Logstash configuration examples | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/config-examples.html) I'm not sure how can we help you since you did not provide any logstash elements. You should take a look into your configuration try to understand the parsing and the logs coming in. Feel free to ask any question ! ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 13, 2023, 9:49am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/3 "2023-11-13T09:49:28Z")
Welcome to the community Trung You should use [csv plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html) to parse the message. There is many samples on [https://discuss.elastic.co/](https://discuss.elastic.co/) Please do not post the pic, the text format is more usable. ---
**Author:** ![Trung\_Nguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trung_nguyen/32/127478_2.png) [@Trung\_Nguyen](https://discuss.elastic.co/u/Trung_Nguyen)\ **Post date:** [November 14, 2023, 2:20am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/4 "2023-11-14T02:20:33Z")
thank a lot for quick reply, I got the log and working on it now. ---
**Author:** ![Trung\_Nguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trung_nguyen/32/127478_2.png) [@Trung\_Nguyen](https://discuss.elastic.co/u/Trung_Nguyen)\ **Post date:** [November 14, 2023, 2:29am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/5 "2023-11-14T02:29:02Z")
thank a lot for your reference, I got the csv log and working on it to apply the csv filter. I do not know why Paolo Alto syslog reference add "FUTURE\_USE" in there log parsing that why it can not convert to the right csv in to logstash 😃 ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 14, 2023, 8:30am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/6 "2023-11-14T08:30:59Z")
If you do not need field, you can remove it by using mutate{ remove\_field... or you use the prune filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 12, 2023, 8:31am UTC](https://discuss.elastic.co/t/field-and-value-missmatch-paolo-alto-os11-paring-logstash-elastic-kibana/346969/7 "2023-12-12T08:31:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.