Logstash syslog output to Arcsight

Elastic Stack Logstash
1

We are using LS to collect syslogs from a firewall and forwarding to siem. this is our config

syslog {
appname => ""
host => "x.x.x.x"
port => "514"
protocol => "tcp"
codec => line { format => "%{message}"}
}
The siem doesn't seem to parse it correctly. Can i ask if I need to include any other tags besides %{message} ?
thanks.

2

What does the SIEM expect to see? What is Logstash currently sending? Should you really be overriding the codec's format option?

3

LS is current sending the %message part. If I want to send what is originally received without any manipulation to another destination (as syslogs format), what would be the correct way to do this in LS?

If overriding the codec's format is an issue, then what is the correct codec to use?
thanks.

4

f I want to send what is originally received without any manipulation to another destination (as syslogs format), what would be the correct way to do this in LS?

Logstash isn't a transparent proxy so there's no guarantee that a received message will be transmitted in exactly the same format.

If overriding the codec's format is an issue, then what is the correct codec to use?

I'd assume that the default codec would produce the best results.