`.
#cloud.auth:
#================================ Outputs =====================================
# Configure what output to use when sending the data collected by the beat.
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
# Protocol - either `http` (default) or `https`.
#protocol: "https"
# Authentication credentials - either API key or username/password.
#api_key: "id:api_key"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
#output.logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Processors =====================================
# Configure processors to enhance or manipulate events generated by the beat.
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
#============================== X-Pack Monitoring ===============================
# filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
# reporting is disabled by default.
# Set to true to enable the monitoring reporter.
#monitoring.enabled: false
# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
#monitoring.cluster_uuid:
#monitoring.elasticsearch:
#================================= Migration ==================================
# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true
[root@localhost filebeat]#
```
I also enabled pawn module, and I configured it as follows:
```
[root@localhost modules.d]# cat panw.yml
# Module: panw
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-panw.html
- module: panw
panos:
enabled: true
# Set which input to use between syslog (default) or file.
var.input: file
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
var.paths: ["/home/user/Descargas/paloalto.20200303"]
```
What shouId do to ingest the palo alto logs? maybe i´m doing something wrong.
Thank you very much for help.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 10, 2020, 8:46am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/5 "2020-03-10T08:46:30Z")
You can try this way:
./filebeat -e -d input
... and touch a couple of files in your logged directories.
BTW with -d switch, you can enable particular log selectors. "\*" enables all of them.
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 10, 2020, 8:57am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/6 "2020-03-10T08:57:27Z")
@mtojek thank you very much for answer.
About running filebeat with the command you said, will I be able to catch the palo alto logs to Elasticsearch with it?
Are my config files properly configured? I don´t know if I have to configure something more.
Thank you very much in advance.
Regards
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 10, 2020, 8:09pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/7 "2020-03-10T20:09:59Z")
@mtojek after using the command filebeat -e -d input I see the following output:
```
[root@localhost filebeat]# filebeat -e -d input
2020-03-10T21:07:57.773+0100 INFO instance/beat.go:622 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-03-10T21:07:57.773+0100 INFO instance/beat.go:630 Beat ID: 7378502a-3d94-4710-99da-ccfc35ae4bcd
2020-03-10T21:08:00.777+0100 INFO add_cloud_metadata/add_cloud_metadata.go:89 add_cloud_metadata: hosting provider type not detected.
2020-03-10T21:08:00.777+0100 INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
2020-03-10T21:08:00.777+0100 INFO [beat] instance/beat.go:958 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "7378502a-3d94-4710-99da-ccfc35ae4bcd"}}}
2020-03-10T21:08:00.777+0100 INFO [beat] instance/beat.go:967 Build info {"system_info": {"build": {"commit": "c1c49432bdc53563e63e9d684ca3e9843626e448", "libbeat": "7.6.1", "time": "2020-02-28T23:12:26.000Z", "version": "7.6.1"}}}
2020-03-10T21:08:00.777+0100 INFO [beat] instance/beat.go:970 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":2,"version":"go1.13.8"}}}
2020-03-10T21:08:00.778+0100 INFO [beat] instance/beat.go:974 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-03-10T20:29:33+01:00","containerized":false,"name":"localhost.localdomain","ip":["127.0.0.1/8","::1/128","192.168.0.29/24","fe80::1bd3:953f:8943:cdaf/64","192.168.122.1/24"],"kernel_version":"3.10.0-1062.12.1.el7.x86_64","mac":["08:00:27:fd:5b:47","52:54:00:19:dd:b5","52:54:00:19:dd:b5"],"os":{"family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":7,"patch":1908,"codename":"Core"},"timezone":"CET","timezone_offset_sec":3600,"id":"08d134ea87a146a0b7436492458816c1"}}}
2020-03-10T21:08:00.778+0100 INFO [beat] instance/beat.go:1003 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"ambient":null}, "cwd": "/etc/filebeat", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 5418, "ppid": 3325, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2020-03-10T21:07:56.920+0100"}}}
2020-03-10T21:08:00.779+0100 INFO instance/beat.go:298 Setup Beat: filebeat; Version: 7.6.1
2020-03-10T21:08:00.779+0100 INFO [index-management] idxmgmt/std.go:182 Set output.elasticsearch.index to 'filebeat-7.6.1' as ILM is enabled.
2020-03-10T21:08:00.779+0100 INFO elasticsearch/client.go:174 Elasticsearch url: http://localhost:9200
2020-03-10T21:08:00.779+0100 INFO [publisher] pipeline/module.go:110 Beat name: localhost.localdomain
2020-03-10T21:08:00.780+0100 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2020-03-10T21:08:00.780+0100 INFO instance/beat.go:439 filebeat start running.
2020-03-10T21:08:00.823+0100 INFO registrar/registrar.go:145 Loading registrar data from /var/lib/filebeat/registry/filebeat/data.json
2020-03-10T21:08:00.823+0100 INFO registrar/registrar.go:152 States Loaded from registrar: 3
2020-03-10T21:08:00.823+0100 INFO crawler/crawler.go:72 Loading Inputs: 1
2020-03-10T21:08:00.824+0100 DEBUG [input] log/config.go:204 recursive glob enabled
2020-03-10T21:08:00.824+0100 DEBUG [input] log/input.go:164 exclude_files: []. Number of stats: 3
2020-03-10T21:08:00.824+0100 DEBUG [input] file/states.go:68 New state added for /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.824+0100 DEBUG [input] file/states.go:68 New state added for /home/user/Descargas/umbrella.20200303
2020-03-10T21:08:00.824+0100 DEBUG [input] log/input.go:185 input with previous states loaded: 2
2020-03-10T21:08:00.824+0100 INFO log/input.go:152 Configured paths: [/home/user/Descargas/paloalto.20200303 /home/user/Descargas/umbrella.20200303]
2020-03-10T21:08:00.824+0100 INFO input/input.go:114 Starting input of type: log; ID: 13993002853132907255
2020-03-10T21:08:00.828+0100 DEBUG [input] log/input.go:191 Start next scan
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:421 Check file for harvesting: /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:511 Update existing file for harvesting: /home/user/Descargas/paloalto.20200303, offset: 2112756165
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:565 File didn't change: /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:421 Check file for harvesting: /home/user/Descargas/umbrella.20200303
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:511 Update existing file for harvesting: /home/user/Descargas/umbrella.20200303, offset: 0
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:520 Resuming harvesting of file: /home/user/Descargas/umbrella.20200303, offset: 0, new size: 364292477
2020-03-10T21:08:00.829+0100 DEBUG [input] log/input.go:212 input states cleaned up. Before: 2, After: 2, Pending: 0
2020-03-10T21:08:00.829+0100 INFO log/harvester.go:297 Harvester started for file: /home/user/Descargas/umbrella.20200303
2020-03-10T21:08:00.830+0100 DEBUG [input] log/config.go:204 recursive glob enabled
2020-03-10T21:08:00.830+0100 DEBUG [input] log/input.go:164 exclude_files: [(?-s:.)gz(?-m:$)]. Number of stats: 3
2020-03-10T21:08:00.830+0100 DEBUG [input] file/states.go:68 New state added for /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.833+0100 DEBUG [input] log/input.go:185 input with previous states loaded: 1
2020-03-10T21:08:00.836+0100 INFO log/input.go:152 Configured paths: [/home/user/Descargas/paloalto.20200303]
2020-03-10T21:08:00.836+0100 INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 1
2020-03-10T21:08:00.836+0100 INFO cfgfile/reload.go:171 Config reloader started
2020-03-10T21:08:00.840+0100 DEBUG [input] log/config.go:204 recursive glob enabled
2020-03-10T21:08:00.840+0100 DEBUG [input] log/input.go:164 exclude_files: [(?-s:.)gz(?-m:$)]. Number of stats: 3
2020-03-10T21:08:00.840+0100 DEBUG [input] file/states.go:68 New state added for /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.840+0100 DEBUG [input] log/input.go:185 input with previous states loaded: 1
2020-03-10T21:08:00.840+0100 INFO log/input.go:152 Configured paths: [/home/user/Descargas/paloalto.20200303]
2020-03-10T21:08:00.840+0100 INFO elasticsearch/client.go:174 Elasticsearch url: http://localhost:9200
2020-03-10T21:08:00.843+0100 INFO elasticsearch/client.go:757 Attempting to connect to Elasticsearch version 7.6.0
2020-03-10T21:08:00.874+0100 INFO [license] licenser/es_callback.go:50 Elasticsearch license: Basic
2020-03-10T21:08:00.881+0100 INFO input/input.go:114 Starting input of type: log; ID: 14528820469630532633
2020-03-10T21:08:00.881+0100 INFO cfgfile/reload.go:226 Loading of config files completed.
2020-03-10T21:08:00.881+0100 DEBUG [input] log/input.go:191 Start next scan
2020-03-10T21:08:00.882+0100 DEBUG [input] log/input.go:421 Check file for harvesting: /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.882+0100 DEBUG [input] log/input.go:511 Update existing file for harvesting: /home/user/Descargas/paloalto.20200303, offset: 2112756165
2020-03-10T21:08:00.882+0100 DEBUG [input] log/input.go:565 File didn't change: /home/user/Descargas/paloalto.20200303
2020-03-10T21:08:00.882+0100 DEBUG [input] log/input.go:212 input states cleaned up. Before: 1, After: 1, Pending: 0
```
No data is being indexed in Elasticsearch... I don´t know what´s happening here. Could you help me, please?
Thank you very much
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 11, 2020, 8:08am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/8 "2020-03-11T08:08:50Z")
As I said, try touching some of this files, creating new ones in directories. You can also record some network traffic using tcpdump to see if your logs are being sent to ES.
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 11, 2020, 8:13am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/9 "2020-03-11T08:13:39Z")
I don´t know what you mean with "touching". Do you mean to modify the Palo Alto log file?
Is there any problem with configuration in Filebeat?
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 11, 2020, 8:14am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/10 "2020-03-11T08:14:33Z")
> **[touch (command)](https://en.wikipedia.org/wiki/Touch_(command))**
>
> In computing, touch is a command used to update the access date and/or modification date of a computer file or directory. It is included in Unix and Unix-like operating systems, TSC's FLEX, Digital Research/Novell DR DOS, the AROS shell, the Microware OS-9 shell, and ReactOS.
> The command is also available for FreeDOS and Microsoft Windows.
> In its default usage, it is the equivalent of creating or opening a file and saving it without any change to the file contents. touch avoids opening, savin...
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 11, 2020, 8:20am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/11 "2020-03-11T08:20:26Z")
Oh, you mean to create blank files in the directory or with some content. Actually, there are also another files in the directory, but the thing is to first ingest Palo Alto logs, and then try anothers. I will try to extract new one Palo Alto log, and trying again to run filebeat....
It should ingest it in Elasticsearch automatically, right? Filebeat configuration is fine?
Thank you very much!
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 11, 2020, 7:42pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/12 "2020-03-11T19:42:05Z")
@mtojek I did what you said, I modify the directory. When I index data, It is not parsed. This is the data I saw in Kibana:
```
@timestamp: Mar 11, 2020 @ 19:33:30.490 host.id: 08d134ea87a146a0b7436492458816c1 host.containerized: false host.hostname: localhost.localdomain
host.architecture: x86_64 host.os.name: CentOS Linux host.os.kernel: 3.10.0-1062.12.1.el7.x86_64
host.os.codename: Core host.os.platform: centos host.os.version: 7 (Core) host.os.family: redhat host.name: localhost.localdomain agent.id: 7378502a-3d94-4710-99da-ccfc35ae4bcd agent.version: 7.6.1 agent.type: filebeat agent.ephemeral_id: 47eb6b02-45f8-429e-b476-c6c01db5bfec agent.hostname: localhost.localdomain ecs.version: 1.4.0 log.offset: 490,382,016 log.file.path: /home/user/Descargas/paloalto2 message:<14>Mar 3 11:41:15 google LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|8.1.10|deny|cat=TRAFFIC| ReceiveTime=2020/03/03....
```
What Im doing wrong? it should get it automatically, right?
There are even some events in Kibana which fields are timestamp and message... so parsing is not going well.
Thanks
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 12, 2020, 7:46am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/13 "2020-03-12T07:46:41Z")
What do you see in ElasticSearch? You can use API to directly access documents stored in ES.
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 12, 2020, 8:12am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/14 "2020-03-12T08:12:10Z")
@mtojek, I see the fields I showed you in the last reply. The fields of "message" are not getting parsed properly, thats the main problem. Now data is being indexed in Elasticsearch, but Filebeat is not parsing the fields and values of the "message".
Can you help me?
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 12, 2020, 11:29am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/15 "2020-03-12T11:29:03Z")
I assumed that you configured ingest pipeline for panw/panos? Please compare your logs with files in "test" directory (e.g. traffic.log, pan\_inc\_traffic.log). Make sure that you're using the same field sepator or reconfigure to yours.
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 12, 2020, 11:52am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/16 "2020-03-12T11:52:26Z")
I followed the documentation:"The ingest pipelines used to parse log lines are set up automatically the first time you run the module, assuming the Elasticsearch output is enabled."
So I guess pipelines are going automatically since my output is Elasticsearch, and not Logstash.
I showed my filebeat.yml config in lasts messages. I enabled pawn module, and it´s configured like I showed in lasts messages.
Anyway, I run the command "filebeat setup --pipelines --modules panw" when I configured it.
I only want to parse a pan-os log file, other files are in different format and need Logstash to parse them. So the focus is only one file.
The thing is, Im able to ingest data to Elasticsearch from pan-os log, but the data is not having parsed in field:value. I just see the field "message" with the full information of the log, but not in separated fields, as it should be. So, the problem is that Filebeat pawn module is not parsing properly the pan-os log. Pan-os log is the only file I want to ingest in Elasticsearch with Filebeat.
Maybe I missconfigured something, but that´s what Im trying to say.
Thanks.
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 12, 2020, 8:47pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/17 "2020-03-12T20:47:32Z")
```
{
"_index": "filebeat-7.6.1-2020.03.10-000001",
"_type": "_doc",
"_id": "HXJe0HABrJOeGnf1wD6o",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2020-03-12T20:10:32.472Z",
"message": "<14>Mar 3 01:11:41 google LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|8.1.10|allow|cat=TRAFFIC| ReceiveTime=2020/03/03 01:11:40|SerialNumber=001801044140|Type=TRAFFIC|Subtype=end|devTime=$cef-formatted-receive_ time|src=0.0.0.0|dst=ip|srcPostNAT=ip|dstPostNAT=ip|RuleName=RP-OUT-03|usrName=| SourceUser=|DestinationUser=|Application=soap|VirtualSystem=vsys1|SourceZone=Produccion| DestinationZone=Outside|IngressInterface=ethernet1/1|EgressInterface=ethernet2| LogForwardingProfile=SIEM|SessionID=1|RepeatCount=1|srcPort=40679|dstPort=3129| srcPostNATPort=0|dstPostNATPort=0|Flags=0x144000|proto=tcp|action=allow| totalBytes=27235|dstBytes=7380|srcBytes=19855|totalPackets=43|StartTime=2020/03/03 01:09:28| ElapsedTime=11|URLCategory=license-expired|sequence=7768340108|ActionFlags=0x0| SourceLocation=ip|DestinationLocation=Poland|dstPackets=18|srcPackets=25| SessionEndReason=aged-out|DeviceGroupHierarchyL1=0| DeviceGroupHierarchyL2=0|DeviceGroupHierarchyL3=0| DeviceGroupHierarchyL4=0|vSrcName=|DeviceName=user| ActionSource=from-policy|SrcUUID=|DstUUID=|TunnelID=0| MonitorTag=|ParentSessionID=0|ParentStartTime=| TunnelType=N/A",
"input": {
"type": "log"
},
"event": {
"module": "panw",
"dataset": "panw.panos",
"timezone": "+01:00"
},
"host": {
"name": "localhost.localdomain",
"hostname": "localhost.localdomain",
"architecture": "x86_64",
"os": {
"platform": "centos",
"version": "7 (Core)",
"family": "redhat",
"name": "CentOS Linux",
"kernel": "3.10.0-1062.12.1.el7.x86_64",
"codename": "Core"
},
"id": "08d134ea87a146a0b7436492458816c1",
"containerized": false
},
"log": {
"file": {
"path": "/home/user/Descargas/paloalto2"
},
"offset": 2075354276
},
"tags": [
"pan-os"
],
"fileset": {
"name": "panos"
},
"service": {
"type": "panw"
},
"agent": {
"version": "7.6.1",
"type": "filebeat",
"ephemeral_id": "c28e5b8c-dbe7-46b6-8719-da8cec5feba0",
"hostname": "localhost.localdomain",
"id": "7378502a-3d94-4710-99da-ccfc35ae4bcd"
},
"ecs": {
"version": "1.4.0"
}
},
"fields": {
"suricata.eve.timestamp": [
"2020-03-12T20:10:32.472Z"
],
"@timestamp": [
"2020-03-12T20:10:32.472Z"
]
},
"sort": [
1584043832472
]
}
```
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 13, 2020, 8:17am UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/18 "2020-03-13T08:17:08Z")
Please hit this URL address: [http://localhost:9200/\_ingest/pipeline](http://localhost:9200/_ingest/pipeline) . Can you find a description "Pipeline for Palo Alto Networks PAN-OS Logs" ?
If not, you haven't configured the pipeline, so:
```
filebeat modules enable panw
filebeat setup -e --pipelines -d '*'
```
---
### Author:  [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)
#### Post date: [March 13, 2020, 12:23pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/19 "2020-03-13T12:23:28Z")
Yes, I found it:
`{"filebeat-7.6.1-panw-panos-pipeline":{"description":"Pipeline for Palo Alto Networks PAN-OS Logs","processors":[{"rename":{"target_field":"log.original","field":"message"}},{"date":{"field":"_temp_.generated_time","formats":["yyyy/MM/dd HH:mm:ss"],"on_failure":[{"append":{"field":"error.message","value":"{{ _ingest.on_failure_message }}"}}],"if":"ctx.event.timezone == null"}},{"date":{"if":"ctx.event.timezone != null","field":"_temp_.generated_time","formats":["yyyy/MM/dd HH:mm:ss"],"timezone":"{{ event.timezone }}","on_failure":[{"append":{"value":"{{ _ingest.on_failure_message }}","field":"error.message"}}]}},{"date":{"formats":["yyyy/MM/dd HH:mm:ss"],"on_failure":[{"append":{"field":"error.message","value":"{{ _ingest.on_failure_message }}"}}],"if":"ctx.event.timezone == null && ctx.event.created != null ","field":"event.created","target_field":"event.created"}},{"date":{"field":"event.created","target_field":"event.created","formats":["yyyy/MM/dd HH:mm:ss"],"timezone":"{{ event.timezone }}","on_failure":[{"append":{"field":"error.message","value":"{{ _ingest.on_failure_message }}"}}],"if":"ctx.event.timezone != null && ctx.event.created != null "}},{"date":{"formats":["yyyy/MM/dd HH:mm:ss"],"on_failure":[{"append":{"value":"{{ _ingest.on_failure_message }}","field":"error.message"}}],"if":"ctx.event.timezone == null && ctx.event.start != null","field":"event.start","target_field":"event.start"}},{"date":{"on_failure":[{"append":{"field":"error.message","value":"{{ _ingest.on_failure_message }}"}}],"if":"ctx.event.timezone != null && ctx.event.start != null","field":"event.start","target_field":"event.start","timezone":"{{ event.timezone }}","formats":["yyyy/MM/dd HH:mm:ss"]}},{"convert":{"type":"long","ignore_missing":true,"field":"client.bytes"}},{"convert":{"ignore_missing":true,"field":"client.packets","type":"long"}},{"convert":{"type":"long","ignore_missing":true,"field":"client.port"}},{"convert":{"type":"long","ignore_missing":true,"field":"server.bytes"}},{"convert":{"type":"long","ignore_missing":true,"field":"server.packets"}},{"convert":{"type":"long","ignore_missing":true,"field":"server.port"}},{"convert":{"field":"source.bytes","type":"long","ignore_missing":true}},{"convert":{"ignore_missing":true,"field":"source.packets","type":"long"}},{"convert":{"field":"source.port","type":"long","ignore_missing":true}},{"convert":{"ignore_missing":true,"field":"destination.bytes","type":"long"}},{"convert":{"field":"destination.packets","type":"long","ignore_missing":true}},{"convert":{"ignore_missing":true,"field":"destination.port","type":"long"}},{"convert":{"type":"long","ignore_missing":true,"field":"network.bytes"}},{"convert":{"ignore_missing":true,"field":"network.packets","type":"long"}},{"convert":{"type":"long","ignore_missing":true,"field":"event.duration"}},{"convert":{"field":"_temp_.labels","type":"long","ignore_missing":true}},{"convert":{"ignore_missing":true,"field":"panw.panos.sequence_number","type":"long"}},{"convert":{"field":"source.nat.port","type":"long","ignore_missing":true}},{"convert":{"field":"destination.nat.port","type":"long","ignore_missing":true}},{"remove":{"if":"ctx?.panw?.panos?.network?.pcap_id == \"0\"","field":["panw.panos.network.pcap_id"]}},{"script":{"if":"ctx?._temp_?.labels != null && ctx._temp_.labels != 0","params":{"ssl_decrypted":16777216,"symmetric_return":2048,"pcap_included":2147483648,"ipv6_session":33554432,"container_page":32768,"nat_translated":4194304,"x_forwarded_for":524288,"http_proxy":262144,"captive_portal":2097152,"temporary_match":8192,"url_filter_denied":8388608},"source":"def labels = ctx?.labels; if (labels == null) {\n labels = new HashMap();\n ctx['labels'] = labels;\n} long value = ctx._temp_.labels; for (entry in params.entrySet()) {\n if ((value & entry.getValue()) != 0) {\n labels[entry.getKey()] = true;\n }\n}\n","lang":"painless"}},{"script":{"params":{"NANOS_IN_A_SECOND":1000000000},"source":"long nanos = ctx['event']['duration'] * params.NANOS_IN_A_SECOND; ctx['event']['duration'] = nanos; def start = ctx.event?.start; if (start != null) {\n ctx.event['end'] = ZonedDateTime.parse(start).plusNanos(nanos);\n}\n","lang":"painless","if":"ctx?.event?.duration != null"}},{"set":{"if":"ctx?._temp_?.message_type == \"TRAFFIC\" && ctx?.panw?.panos?.source?.zone == \"untrust\" && ctx?.panw?.panos?.destination?.zone == \"trust\"","field":"network.direction","value":"inbound"}},{"set":{"if":"ctx?._temp_?.message_type == \"TRAFFIC\" && ctx?.panw?.panos?.source?.zone == \"trust\" && ctx?.panw?.panos?.destination?.zone == \"untrust\"","field":"network.direction","value":"outbound"}},{"set":{"if":"ctx?._temp_?.message_type == \"TRAFFIC\" && ctx?.panw?.panos?.source?.zone == \"trust\" && ctx?.panw?.panos?.destination?.zone == \"trust\"","field":"network.direction","value":"internal"}},{"set":{"if":"ctx?._temp_?.message_type == \"TRAFFIC\" && ctx?.panw?.panos?.source?.zone == \"untrust\" && ctx?.panw?.panos?.destination?.zone ==`
Panw module is properly installed. The main problem is the data is not getting parsed properly to Elasticsearch...
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 13, 2020, 3:42pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/20 "2020-03-13T15:42:30Z")
You can try this approach to define a pipeline: [https://www.elastic.co/guide/en/beats/filebeat/7.6/configuring-ingest-node.html](https://www.elastic.co/guide/en/beats/filebeat/7.6/configuring-ingest-node.html)
[Next page](https://discuss.elastic.co/t/palo-alto-logs/222511.md?page=2)