# Filter the palo alto Global protect logs

**URL:** <https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405>\
**Category:** Logstash\
**Created:** [December 12, 2017, 6:21pm UTC](https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405 "2017-12-12T18:21:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rpendela](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@rpendela](https://discuss.elastic.co/u/rpendela)\
**Post date:** [December 12, 2017, 6:21pm UTC](https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405/1 "2017-12-12T18:21:52Z")

</div>

Hello Community,

We recently implemented ELK stack using docker compose, I am trying to visualize the palo alto global protect logs for login status and ip address.

Below snip to give idea how I am filtering for system logs in my pipeline, and I am able to receive the fields in CSV filter but for global protect log info is inside the "Description:" field. , How can I further filter this to get the login details from the "Description:" field?

Here is the pipeline

```
input {
syslog {
    timezone => "America/Chicago"
    port => "1514"
    type => "syslog"
}

```

}

filter {  
if ([message] =~ /SYSTEM/) {  
csv {  
source =\> "message"  
columns =\> [  
"FUTURE\_USE", "ReceiveTime", "SerialNumber", "Type", "Threat\_ContentType", "FUTURE\_USE",  
"GeneratedTime", "VirtualSystem", "EventID", "Object", "FUTURE\_USE", "FUTURE\_USE", "Module",  
"Severity", "Description", "SequenceNumber", "ActionFlags", "DeviceGroupHierarchyLevel1",  
"DeviceGroupHierarchyLevel1", "DeviceGroupHierarchyLevel2", "DeviceGroupHierarchyLevel3",  
"DeviceGroupHierarchyLevel4", "VirtualSystemName", "DeviceName"  
]  
}  
}  
mutate {  
# Original message has been fully parsed, so remove it.  
remove\_field =\> ["message"]  
}

```
    # Geolocate logs that have SourceIP if that SourceIP is a non-RFC1918 address
    if [SourceIP] and [SourceIP] !~ "(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|(^169\.254\.)" {
        geoip {
           source => "SourceIP"
           target => "SourceIPGeo"
      }

        # Delete 0,0 in SourceIPGeo.location if equal to 0,0
        if ([SourceIPGeo.location] and [SourceIPGeo.location] =~ "0,0") {
            mutate {
                replace => ["SourceIPGeo.location", ""]
            }
        }
    }

    # Geolocate logs that have DestinationIP and if that DestinationIP is a non-RFC1918 address
    if [DestinationIP] and [DestinationIP] !~ "(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|(^169\.254\.)" {
        geoip {
            source => "DestinationIP"
            target => "DestinationIPGeo"
        }
  
        # Delete 0,0 in DestinationIPGeo.location if equal to 0,0
        if ([DestinationIPGeo.location] and [DestinationIPGeo.location] =~ "0,0") {
            mutate {
                replace => ["DestinationIPGeo.location", ""]
            }
        }
    }
    if [SourceIP] and [DestinationIP] {
        fingerprint {
            concatenate_sources => true
            method => "SHA1"
            key => "logstash"
            source => ["SourceIP", "SourcePort", "DestinationIP", "DestinationPort", "Protocol"]
        }
    }

```

}

output {

```
    elasticsearch {
        hosts => "http://URL"
        user => *****
        password => *******
    index => "paloaltologs-%{+YYYY.MM.dd}"	

    }
stdout { codec => rubydebug }

```

}

Here is the original log format for system logs of palo alto

```
                "FUTURE_USE", "ReceiveTime", "SerialNumber", "Type", "Threat_ContentType", "FUTURE_USE",
                "GeneratedTime", "VirtualSystem", "EventID", "Object", "FUTURE_USE", "FUTURE_USE", "Module",
                "Severity", "Description", "SequenceNumber", "ActionFlags", "DeviceGroupHierarchyLevel1",
                "DeviceGroupHierarchyLevel1", "DeviceGroupHierarchyLevel2", "DeviceGroupHierarchyLevel3",
                "DeviceGroupHierarchyLevel4", "VirtualSystemName", "DeviceName"

```

Sample output data currently I am receiving

EventID: globalprotectportal-auth-succ  
VirtualSystem: -  
Description: \*\*GlobalProtect portal user authentication succeeded. Login from: x.x.x.x, Source region: US, User name: \*\*\*\ ***, Auth type: profile**.  
VirtualSystemName: PANCorpFW1  
type: syslog  
GeneratedTime: December 12th 2017, 04:45:57.000  
@version: 1  
host: 10.3.130.20  
SequenceNumber: 1,717,235  
Threat\_ContentType: globalprotect  
timestamp: Dec 12 10:45:57  
severity: 6  
FUTURE\_USE: 0  
Severity: informational  
priority: 14  
logsource:   
tags: PA-SYSTEM  
Type: SYSTEM  
@timestamp: December 12th 2017, 10:45:57.000  
DeviceGroupHierarchyLevel4: -  
SerialNumber:   
DeviceGroupHierarchyLevel3: 0  
DeviceGroupHierarchyLevel2: 0  
DeviceGroupHierarchyLevel1: 0  
ReceiveTime: December 12th 2017, 04:45:57.000  
Object: GP-Portal  
ActionFlags: 0x0  
Module: general  
facility: 1  
severity\_label: Informational  
indent preformatted text by 4 spaces

**Now I want to visualize the information in the Description field like username, Public IP, region.**

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [December 12, 2017, 8:06pm UTC](https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405/2 "2017-12-12T20:06:12Z")

</div>

Hey @rpendela, I've moved this question to the Logstash "topic" as it's more about ingesting your data via Logstash.

---

<div class="post-metadata">

**Author:** ![rpendela](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@rpendela](https://discuss.elastic.co/u/rpendela)\
**Post date:** [December 13, 2017, 3:49pm UTC](https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405/3 "2017-12-13T15:49:35Z")

</div>

@Brandon_Kobel Who can help me with this?

---

<div class="post-metadata">

**Author:** ![rpendela](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@rpendela](https://discuss.elastic.co/u/rpendela)\
**Post date:** [December 15, 2017, 5:34pm UTC](https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405/4 "2017-12-15T17:34:25Z")

</div>

Can any one help me here?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2018, 5:34pm UTC](https://discuss.elastic.co/t/filter-the-palo-alto-global-protect-logs/111405/5 "2018-01-12T17:34:26Z")

</div>

Closed on January 12, 2018, 5:34pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.