# Filebeat PaloAlto Modules for virtual system field

**URL:** <https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 19, 2020, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987 "2020-11-19T12:41:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fadjar340](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fadjar340/32/43610_2.png) [@fadjar340](https://discuss.elastic.co/u/fadjar340)\
**Post date:** [November 19, 2020, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987/1 "2020-11-19T12:41:03Z")

</div>

This is my little modification to get the paloalto vsys field.  
In the file `/usr/share/filebeat/module/panw/panos/config/input.yml`  
i add 2 lines to make vsys visible in the index, as follow:

```auto
{{ if eq .input "syslog" }}

type: syslog
protocol.udp:
  host: "{{.syslog_host}}:{{.syslog_port}}"

{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

fields_under_root: true
fields:
  observer:
    vendor: Palo Alto Networks
    product: PAN-OS
    type: firewall

processors:
  - add_locale: ~

  - decode_csv_fields:
      fields:
        message: csv

  - extract_array:
      field: csv
      overwrite_keys: true
      omit_empty: true
      mappings:
        event.created: 1
        observer.serial_number: 2
        panw.panos.type: 3
        panw.panos.sub_type: 4
        _temp_.generated_time: 6

  - extract_array:
      when:
        equals:
          panw.panos.type: TRAFFIC
      field: csv
      overwrite_keys: true
      omit_empty: true
      fail_on_error: false
      mappings:
        client.ip: 7
        source.ip: 7
        source.address: 7
        server.ip: 8
        destination.ip: 8
        destination.address: 8
        source.nat.ip: 9
        client.nat.ip: 9
        destination.nat.ip: 10
        server.nat.ip: 10
        panw.panos.ruleset: 11
        client.user.name: 12
        source.user.name: 12
        server.user.name: 13
        destination.user.name: 13
        network.application: 14
        panw.panos.virtual_sys: 15
        panw.panos.source.zone: 16
        observer.ingress.zone: 16
        panw.panos.destination.zone: 17
        observer.egress.zone: 17
        panw.panos.source.interface: 18
        observer.ingress.interface.name: 18
        panw.panos.destination.interface: 19
        observer.egress.interface.name: 19
        panw.panos.flow_id: 22
        client.port: 24
        source.port: 24
        destination.port: 25
        server.port: 25
        source.nat.port: 26
        client.nat.port: 26
        destination.nat.port: 27
        server.nat.port: 27
        _temp_.labels: 28
        network.transport: 29
        panw.panos.action: 30
        network.bytes: 31
        client.bytes: 32
        source.bytes: 32
        server.bytes: 33
        destination.bytes: 33
        network.packets: 34
        event.start: 35
        event.duration: 36
        panw.panos.url.category: 37
        panw.panos.sequence_number: 39
        client.packets: 44
        source.packets: 44
        server.packets: 45
        destination.packets: 45
        panw.panos.endreason: 46
        observer.hostname: 52

  - extract_array:
      when:
       equals:
          panw.panos.type: THREAT
      field: csv
      omit_empty: true
      overwrite_keys: true
      fail_on_error: false
      mappings:
        client.ip: 7
        source.ip: 7
        source.address: 7
        server.ip: 8
        destination.ip: 8
        destination.address: 8
        source.nat.ip: 9
        client.nat.ip: 9
        destination.nat.ip: 10
        server.nat.ip: 10
        panw.panos.ruleset: 11
        client.user.name: 12
        source.user.name: 12
        server.user.name: 13
        destination.user.name: 13
        network.application: 14
        panw.panos.virtual_sys: 15
        panw.panos.source.zone: 16
        observer.ingress.zone: 16
        panw.panos.destination.zone: 17
        observer.egress.zone: 17
        panw.panos.source.interface: 18
        observer.ingress.interface.name: 18
        panw.panos.destination.interface: 19
        observer.egress.interface.name: 19
        panw.panos.flow_id: 22
        client.port: 24
        source.port: 24
        destination.port: 25
        server.port: 25
        source.nat.port: 26
        client.nat.port: 26
        destination.nat.port: 27
        server.nat.port: 27
        _temp_.labels: 28
        network.transport: 29
        panw.panos.action: 30
        panw.panos.threat.resource: 31
        url.original: 31
        panw.panos.threat.name: 32
        panw.panos.url.category: 33
        log.level: 34
        _temp_.direction: 35
        _temp_.srcloc: 38
        _temp_.dstloc: 39
        panw.panos.network.pcap_id: 42
        panw.panos.file.hash: 43
        user_agent.original: 46
        file.type: 47
        network.forwarded_ip: 48
        http.request.referer: 49
        source.user.email: 50
        panw.panos.subject: 51
        destination.user.email: 52
        observer.hostname: 59

  - drop_fields:
      fields:
        - csv

  - community_id: ~

  - community_id:
      target: panw.panos.network.nat.community_id
      fields:
        source_ip: source.nat.ip
        source_port: source.nat.port
        destination_ip: destination.nat.ip
        destination_port: destination.nat.port

  # Copy NAT data from ECS fields to the original non-ECS fields to retain
  # backward compatibility. This should be removed for 8.0.
  - convert:
      ignore_missing: true
      fields:
        - {from: source.nat.ip, to: panw.panos.source.nat.ip, type: ip}
        - {from: destination.nat.ip, to: panw.panos.destination.nat.ip, type: ip}
        - {from: source.nat.port, to: panw.panos.source.nat.port, type: long}
        - {from: destination.nat.port, to: panw.panos.destination.nat.port, type: long}
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.6.0

```

You can see in the TRAFIC and THREAT, I add line with number 15, I put the name `panw.panos.virtual_system:15`

Just save it, and restart the filebeat...  
Then the virtual system shown in the index, and make it permanant into the index using Index Pattern refresh

Below the sample of the fields in JSON

```auto

    },
    "panw": {
      "panos": {
        "virtual_sys": "vsys3",
        "sequence_number": 4587779761,
        "sub_type": "start",
        "flow_id": "33695379",
        "ruleset": "Allow-Out-Bubbly",
        "destination": {
          "nat": {
            "port": 0,
            "ip": "0.0.0.0"
          },

```

Perhaps it's can be add into the next release to bring thr virtual system information available in the Filebeat PaloAlto Module.

Regards,  
Fadjar Tandabawana

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [November 23, 2020, 12:26am UTC](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987/2 "2020-11-23T00:26:10Z")

</div>

Hi @fadjar340, do you have a GitHub account? If so, could you post this as an enhancement issue — or even better, as a pull request — in [https://github.com/elastic/beats](https://github.com/elastic/beats)?

Thanks,

Shaunak

---

<div class="post-metadata">

**Author:** ![fadjar340](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fadjar340/32/43610_2.png) [@fadjar340](https://discuss.elastic.co/u/fadjar340)\
**Post date:** [November 25, 2020, 9:00am UTC](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987/3 "2020-11-25T09:00:39Z")

</div>

Yes, I have it...  
Please add my account: fadjar340 at github

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2020, 11:00am UTC](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987/4 "2020-12-23T11:00:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.