# Palo alto logs

**URL:** <https://discuss.elastic.co/t/palo-alto-logs/222511>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [March 6, 2020, 8:46pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511 "2020-03-06T20:46:00Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [March 13, 2020, 6:14pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/21 "2020-03-13T18:14:15Z")

</div>

@david-vazquez you will not be able to use the Filebeat Palo Alto module. The ingest pipeline is designed to only handle the default Palo Alto log formats. From the example above I can see that your Palo Alto device is configured to send logs using LEEF formatting, which are not supported by the ingest pipeline.

Rob

[![GitHub](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f8ae834f16b1a02d31607317669716807844d84.png)](https://github.com/robcowart) [![YouTube](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43b9b81a8c93786219985aeb5335c1c323449053.png)](https://www.youtube.com/channel/UCivWvTx1DwrWNcDLV58kmOg) [![LinkedIn](https://us1.discourse-cdn.com/elastic/original/3X/6/7/674f3370d0f0542ddc5e408516beb1b7edd6c1bf.png)](https://www.linkedin.com/in/robertcowart/)  
**[How to install Elasticsearch & Kibana on Ubuntu](https://www.youtube.com/watch?v=gZb7HpVOges)**  
**[What is the best storage technology for Elasticsearch?](https://www.youtube.com/watch?v=nKUpfJCBiS4)**

---

<div class="post-metadata">

**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Post date:** [March 13, 2020, 10:54pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/22 "2020-03-13T22:54:27Z")

</div>

Thank you very much for your answer 🙂  
I will try with Logstash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2020, 10:54pm UTC](https://discuss.elastic.co/t/palo-alto-logs/222511/23 "2020-04-10T22:54:42Z")

</div>

Closed on April 10, 2020, 10:54pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/palo-alto-logs/222511.md?page=1)