# Monitoring Palo alto networks firewalls with ELK

**URL:** <https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [July 19, 2020, 3:21pm UTC](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804 "2020-07-19T15:21:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zkhanfur](https://avatars.discourse-cdn.com/v4/letter/z/97f17d/32.png) [@zkhanfur](https://discuss.elastic.co/u/zkhanfur)\
**Post date:** [July 19, 2020, 3:21pm UTC](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804/1 "2020-07-19T15:21:13Z")

</div>

Hi dear community,  
I have been following a blog to create Dashboards for Palo alto networks firewalls and good progress has been made. The blog post that has been used is

> **[Monitoring firewall with ELK – Palo alto networks | Zeglory.com](https://zeglory.com/monitoring-firewall-with-elk-paloalto-networks/)**
>
> Either you are a Cisco person or you are not! I am one of those who were and may be still am, however, I also really love technology and admire innovative technology. I was introduced to Palo alto net

We have successfully replicated the dashboards to the extent we want. However, we have some challenges with Timelion filters or query.

In order to create a more complex query to for example show allowed and dropped traffic and furthermore drill down at department level, how can this query be applied in kibana under timelion? We are using

`.es(q=action:drop).lines(fill=2).color(red).label("Dropped traffic today")`

which works, however, as soon as we try adding (q=action:drop or allow and user:someuser) the console returns errors. We have also tried using (q=action:drop or action:allow and department:somedepartment)

Is there any detailed description and instructions with regards to use of timelion besides [https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero](https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero) or [https://www.elastic.co/guide/en/kibana/current/timelion.html](https://www.elastic.co/guide/en/kibana/current/timelion.html), none of which show any complex queries on the data. May be we are just over complicating and this is not the intended usage of Timelion? Will greatly appreciate any advice or guidance. Thanking you in advance, and thank you much for such a great product i.e. ELK stack 🙂

BR,  
Rune

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [August 13, 2020, 10:29am UTC](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804/2 "2020-08-13T10:29:40Z")

</div>

Hi @zkhanfur  
the timelion blogpost [https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero](https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero) shows that the query use the query dsl mini-language: [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax)

in your case the query can be written as `q="action:(drop OR allow) AND user:someuser"` using the quotation marks and the parenthesis where needed.

---

<div class="post-metadata">

**Author:** ![zkhanfur](https://avatars.discourse-cdn.com/v4/letter/z/97f17d/32.png) [@zkhanfur](https://discuss.elastic.co/u/zkhanfur)\
**Post date:** [August 13, 2020, 10:50am UTC](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804/3 "2020-08-13T10:50:36Z")

</div>

Hi Markov00, Thank you Soooooo much. I do not know how I missed this, I guess I just was not trying hard enough. Thanks for point this out and also for providing and example that works. Many thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2020, 10:50am UTC](https://discuss.elastic.co/t/monitoring-palo-alto-networks-firewalls-with-elk/241804/4 "2020-09-10T10:50:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.