HI guys, I'm trying to create a logstash pipeline that parses incoming CEF logs, apply some logic and then outputs the log in JSON format to the console. Some logs are a bit complicated to parse since the key=value pairs cannot always be recognized by a simple delimiter. Take the following log fo…

Are these logs from a Palo Alto device, right? Are you able to change the format of the logs that are being sent? If you can, I would recommend that you change it to send logs in csv, it will make it pretty easy to parse the logs. I needed to receive logs from Palo Alto devices a couple of time ag…

Discuss the Elastic Stack

How to extract the entire value of a complicated field?

Elastic Stack Logstash

Badger April 26, 2023, 11:48pm 2

Why not use a cef codec rather than trying to parse CEF using a kv filter? You can use a tcp output/input pair as shown here.

Topic		Replies	Views
Why does this field exist in my output even though I have removed this? Logstash	1	236	May 24, 2023
Parsing message field from CEF logs SIEM	5	1541	April 5, 2022
Parse logs Trent Micro Email Security Elasticsearch	5	93	June 28, 2024
How can I generate a CEF output Logstash	2	897	May 29, 2023
Parse Delimited values from JSON log Logstash	12	1166	June 26, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to extract the entire value of a complicated field?

Related topics