I am testing Filebeat 7.7 with the panw module, and am receiving THREAT type logs, but not TRAFFIC type logs. Elasticsearch version is also 7.7. filebeat.yml config: filebeat.config.modules: path: ${path.config}/modules.d/*.yml output.elasticsearch: hosts: ["host1", "host2"] loadbalance: tru…

This message is formatted differently than the pipeline expects: Jul 1 05:00:00 firewall 2020/07/01 05:00:00,0008C100362,TRAFFIC,drop,192.168.1.1,192.168.1.2,0.0.0.0,0.0.0.0,RuleName,,,not-applicable,vsys1,Zone1,Zone2,ethernet1/11,,sharedPanorama,0,1,59589,443,0,0,0x4000,tcp,deny,66,1,2020/07/01 0…

Discuss the Elastic Stack

Filebeat 7.7 panw module sends THREAT, but not TRAFFIC logs

Elastic Stack Beats

kvch (Noémi Ványi) July 6, 2020, 3:27pm 2

Could you please share the debug logs Filebeat (./filebeat -e -d "*")?

Topic		Replies	Views
Filebeat-panw Module timezone issues Beats filebeat	8	2028	November 5, 2019
Filebeat PANW Module Not Working (continued) Beats filebeat	3	775	April 30, 2020
Filebeat 8.4.2 modules Panw : Panw modules does not parse log correctly Beats beats-module , filebeat	1	334	October 25, 2022
Schema Bug in Filebeat panw Module Beats elastic-stack-security , filebeat	4	494	September 14, 2019
No data from Filebeat 7.7 - Using Palo Alto module Beats filebeat	2	556	June 19, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat 7.7 panw module sends THREAT, but not TRAFFIC logs

Related topics