HI guys, I'm trying to create a logstash pipeline that parses incoming CEF logs, apply some logic and then outputs the log in JSON format to the console. Some logs are a bit complicated to parse since the key=value pairs cannot always be recognized by a simple delimiter. Take the following log fo…

Are these logs from a Palo Alto device, right? Are you able to change the format of the logs that are being sent? If you can, I would recommend that you change it to send logs in csv, it will make it pretty easy to parse the logs. I needed to receive logs from Palo Alto devices a couple of time ag…

Discuss the Elastic Stack

How to extract the entire value of a complicated field?

Elastic Stack Logstash

Badger April 26, 2023, 11:48pm 2

Why not use a cef codec rather than trying to parse CEF using a kv filter? You can use a tcp output/input pair as shown here.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.