# Juniper log ingestion **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 22, 2021, 1:28pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964 "2021-04-22T13:28:23Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 22, 2021, 1:28pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/1 "2021-04-22T13:28:24Z")
I am trying to ingest juniper log via filebeat using juniper module but it does not give me systemname and RT\_FLOW anywhere in my ELK data. how do I get that? source = dc-fw1 Can I modify this module and add my own process to retrieve/delete fields? `<14>1 2021-04-16T08:00:39.489-05:00 dc-fw1 RT_FLOW - APPTRACK_SESSION_CLOSE [junos@2636.1.1.1.2.140 reason=\"ICMP error\" source-address=\"10.10.94.62\" source-port=\"36931\" destination-address=\"10.25.63.18\" destination-port=\"161\" service-name=\"None\" application=\"SNMP\" nested-application=\"UNKNOWN\" nat-source-address=\"10.10.94.62\" nat-source-port=\"36931\" nat-destination-address=\"10.25.63.18\" nat-destination-port=\"161\" src-nat-rule-name=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"17\" policy-name=\"20201029\" source-zone-name=\"trusted-ent\" destination-zone-name=\"trusted-prod\" session-id-32=\"62595271\" packets-from-client=\"2\" bytes-from-client=\"142\" packets-from-server=\"0\" bytes-from-server=\"0\" elapsed-time=\"3\" username=\"N/A\" roles=\"N/A\" encrypted=\"No\" profile-name=\"N/A\" rule-name=\"N/A\" routing-instance=\"default\" destination-interface-name=\"et-1/0/0.207\" uplink-incoming-interface-name=\"N/A\" uplink-tx-bytes=\"0\" uplink-rx-bytes=\"0\" category=\"Infrastructure\" sub-category=\"Monitoring\" apbr-policy-name=\"N/A\" amr-rule-name=\"N/A\"]"` ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [April 24, 2021, 10:06am UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/2 "2021-04-24T10:06:40Z")
Is this from an SRX? Are you using the juniper module with the SRX fileset or the Junos fileset enabled? Looking at the logs they look quite like srx logs, and just wanted to see if you maybe are not using the correct fileset? ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 26, 2021, 1:05pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/3 "2021-04-26T13:05:48Z")
Asked network team and they said "SRX is the Firewall and Junos is the operating system that it is running. So yes to both." ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [April 26, 2021, 1:27pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/4 "2021-04-26T13:27:42Z")
@elasticforme , Can they configure only the SRX fileset? It does Junos parsing as well, but its extended to support srx specific fields and information as well. ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 27, 2021, 1:09pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/5 "2021-04-27T13:09:42Z")
what would be different fileset ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 27, 2021, 6:23pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/6 "2021-04-27T18:23:49Z")
ok. this is only SRX log I have following enable on my filebeat ``` - module: juniper junos: enabled: true var.input: udp var.syslog_host: elkdev01 var.syslog_port: 1514 srx: enabled: true var.input: udp var.syslog_host: elkdev01 var.syslog_port: 1514 ``` is this seems correct? ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [April 27, 2021, 7:04pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/7 "2021-04-27T19:04:02Z")
@elasticforme , yeah so they set junos to `enabled: false`. They don't need both, the SRX one is more mature and includes Junos logs (from SRX devices). See if that causes some difference first, else you are pretty much creating the same logs twice, and they cant really be listening on the same port either, that would not work. ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 27, 2021, 7:15pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/8 "2021-04-27T19:15:24Z")
Perefect. I got it. I had junos first and hence it was doing that. I turn on SRX first disable junos and I started getting log saying juniper.srx. Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 25, 2021, 9:15pm UTC](https://discuss.elastic.co/t/juniper-log-ingestion/270964/9 "2021-05-25T21:15:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.