Palo Alto Ingest Pipeline: Audit Logs

Elastic Stack Elastic Agent
1

The 2 Grok patterns supplied in the PANW ingest pipelines are not sufficient for parsing audit logs. I have created the grok pattern required to parse PANW audit logs and even submitted a merge request, but no one ever looked at it and it just auto closed.

Every time I update the PANW integration in elasticsearch the managed ingest pipeline is recreated and my grok pattern for the Audit logs is deleted and they start failing to parse. What is the best way to submit a change request for the PANW managed ingest pipeline?

Add Grok pattern for PANW Audit Logs by jameswiggins · Pull Request #16566 · elastic/integrations

2

What integration version are you using?

I suggest that you open an issue in the integrations repository and link your closed PR, so they may reopen it so you can work on it.

Your PR needs to pass all tests, basically you will need to add a sample message that matches your grok to the audit sample file and locally run the tests so the expected output file is generated and it validates that your changes will not break ingestion.

You can read more on how to test here.

A PR without this will not be accepted.