# Palo Alto Firewall Log Collection Issue with Elasticsearch **URL:** \ **Category:** Logstash\ **Created:** [April 18, 2025, 7:20pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296 "2025-04-18T19:20:51Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![zakaria2](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Post date:** [April 18, 2025, 7:20pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/1 "2025-04-18T19:20:51Z")
Hello everyone, I'm having a problem collecting logs from my Palo Alto firewall to my Elastic stack (Elasticsearch, Logstash, Kibana). I configured the Palo Alto firewall to send logs in Syslog format to Logstash (see image 1). I configured the /etc/logstash/conf.d/pa.conf file on the elastic server in the following form to retrieve the logs : input { udp { port =\> 514 type =\> "paloalto" } } filter { if [type] == "paloalto" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:firewall} %{DATA:process}: %{GREEDYDATA:log\_message}" } } date { match =\> ["timestamp", "MMM dd HH:mm:ss"] target =\> "@timestamp" } } } output { if [type] == "paloalto" { elasticsearch { hosts =\> ["A.B.C.D:9200"] index =\> "paloalto-logs-%{+YYYY.MM.dd}" } } } The ports are open, but despite this, no Palo Alto logs appear in Elasticsearch/Kibana. Thanks in advance for your help! ![Image 1](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2ede57426fec418868f04966db3a91f5b73dab26.png) ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [April 19, 2025, 12:21am UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/2 "2025-04-19T00:21:15Z")
First, Tcpdump or something to see if you are getting traffic on that port. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 20, 2025, 2:56pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/3 "2025-04-20T14:56:58Z")
You should check approximately in next order: 1. Because the port 514 has bas been used, you must start LS with the root privileges. Make sure that LS is started, check LS logs, should be a message like listener started at port 514. _`[2025-04-20T16:00:53,772][INFO][logstash.inputs.udp][ls][01827e1d3bc64f8c9fed9dd2744e51e871712acd830c9e4cae89f984d16f99ba] Starting UDP listener {:address=>"0.0.0.0:514"}`_ Also check network connections: `netstat -lnpu` or `ss -uap` 2. Check firewall rules, have you applied correctly, both the network and the local firewall. `iptable -S` or `ufw status` or track logs 3. Simplify pa.conf, keep input as it is, comment/remove everything from filter and add debug in the output ```auto output { stdout {codec => rubydebug} } ``` 1. Use TCPview to track UDP traffic. Set eth. adapter eth0 according your system. `tcpdump -i eth0 udp port 514 -vv -X` 2. When you receive data, return the filter code backup ---
**Author:** ![zakaria2](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Post date:** [April 20, 2025, 4:15pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/4 "2025-04-20T16:15:08Z")
Thanks for your replies, I changed the port 514 to 5514, and it works. I tested with the command echo "test log" | nc -u 0.0.0.0 5514 and I received (see image) : ![Capture d’écran 2025-04-20 171301](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77bdc746eab6f1e3a6904211b06c54e780c5cb2b.png) ---
**Author:** ![zakaria2](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Post date:** [April 20, 2025, 4:25pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/6 "2025-04-20T16:25:57Z")
What is the perfect configuration that I can configure on the /etc/logstash/conf.d/pa.conf file to collect traffic logs from the Palo Alto firewall ? ![Capture d’écran 2025-04-20 172504](https://us1.discourse-cdn.com/elastic/original/3X/9/0/901292a600133239dad44a4210fe73540af7033a.png) ? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 20, 2025, 7:03pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/7 "2025-04-20T19:03:48Z")
The first you should receive a test message from PA as a raw formatted event. Then you can parse by grok, dissect or json. There is also syslog input plugin with cef codec ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [April 21, 2025, 1:15am UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/8 "2025-04-21T01:15:55Z")
Look at the Elastic Agent, I think this is a supplied integration. It may also be supplied in beats. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 21, 2025, 2:34am UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/9 "2025-04-21T02:34:18Z")
Yes, it's possible to use the EA which is a slightly different approach, with everything out-of-box, including data parsing and the dashboard. It depends on the case will be used LS or EA. ---
**Author:** ![zakaria2](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Post date:** [April 23, 2025, 7:02am UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/10 "2025-04-23T07:02:39Z")
The problem I have is that the port configured on logstash and on palo alto is open and listening as you see in the image, even though I have configured the syslog on the firewall, but I do not receive any traffic log from the firewall: ![Capture d’écran 2025-04-23 075306](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9be5251f619f356dbd82076583910b6a43b723c4.png) ![Capture d’écran 2025-04-23 080554](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f08a5cc9b668947bf4a4614d2697ee82953378a.png) ![Capture d’écran 2025-04-23 080203](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d470cb785cadbf72ebf5f5315a24f4653bb8abe.png) ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 23, 2025, 8:07am UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/11 "2025-04-23T08:07:07Z")
You have the log forwarding, that's file. If you are not receiving data, check the local firewall on the LS host and the network firewall or in the data path. ---
**Author:** ![zakaria2](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Post date:** [May 26, 2025, 8:22pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/12 "2025-05-26T20:22:30Z")
Hi, Thank you for your responses. I am now receiving logs from the Palo Alto firewall — it was a routing issue. As you can see in the image, there's a sample of a Palo Alto log that contains two fields: **"event.original"** and **"message"** , both with the same log content. So ideally, I would like to keep only one of them — either remove **event.original** and keep **message** , or the other way around. I’ve configured my `/etc/logstash/conf.d/pa.conf` file with remove field, but the **event.original** field is still present : input { udp { port =\> 5514 type =\> "paloalto" } } filter { if [type] == "paloalto" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:firewall} %{DATA:process}: %{GREEDYDATA:log\_message}" } } date { match =\> ["timestamp", "MMM dd HH:mm:ss"] target =\> "@timestamp" } mutate { remove\_field =\> ["event.original"] } } } output { if [type] == "paloalto" { elasticsearch { hosts =\> ["192.168.41.230:9200"] index =\> "paloalto-logs-%{+YYYY.MM.dd}" } } } ![Capture d’écran 2025-05-26 212208](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60324104a0eea2e42ae43da44783dc02d438366a.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 26, 2025, 9:01pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/13 "2025-05-26T21:01:48Z")
> [@zakaria2](#): > > remove\_field =\> ["event.original"] Change this to `remove_field => ["[event][original]" ]`. logstash can distinguish between fields with . in the name and nested fields, so `{ "a.b": 0 }` would be [a.b], and `{ "a": { "b": 0 } }` would be [a][b]. ---
**Author:** ![zakaria2](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Post date:** [May 26, 2025, 9:33pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/14 "2025-05-26T21:33:34Z")
Thank you for your help, it worked. Now, after that, is it possible to parse the text found in the **"message"** field: \<166\>May 22 10:19:46 FW1-1410-MEDI1TV-TANGER 1,2025/05/22 10:19:46,026709006463,TRAFFIC,end,2817,2025/05/22 10:19:46,192.168.83.111,20.42.73.29,197.230.74.238,20.42.73.29,navigation lan\_83 by group,medi1tv\a.sokrat,,ssl,vsys1,inside,outside,ethernet1/8,ethernet1/12,log-forwarding-profile-medi1tv,2025/05/22 10:19:46,321922,1,62040,443,12357,443,0x140401c,tcp,allow,5745,781,4964,14,2025/05/22 10:19:31,0,any,,7495539264598377358,0x0,192.168.0.0-192.168.255.255,United States,,7,7,decrypt-cert-validation,0,0,0,0,,FW1-1410-MEDI1TV-TANGER,from-policy,,,0,,0,,N/A,0,0,0,0,3a57953a-e9bd-41c9-88f7-5e48cedeedab,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2025-05-22T10:19:46.496+01:00,,,encrypted-tunnel,networking,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,ssl,no,no,0,NonProxyTraffic, Into **separate fields** such as: - **Receive Time** : May 22 10:19:46 - **Type** : end - **From Zone** : inside - **To Zone** : outside - **Source IP** : 192.168.83.111 - **Source User** : medi1tv\a.sokrat - **Destination** : 20.42.73.29 - **To Port** : 443 - **Application** : SSL - **Action** : Allow - **Rule** : navigation lan\_83 by group ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 26, 2025, 10:21pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296/15 "2025-05-26T22:21:55Z")
> [@zakaria2](#): > > is it possible to parse the text found in the **"message"** field [message] is basically a syslog message. Try parsing it using a syslog filter (or dissect) and use a csv filter to extract all the fields.