# Palo alto sent to server via syslog

**URL:** <https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870>\
**Category:** Logstash\
**Created:** [October 18, 2022, 9:40am UTC](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870 "2022-10-18T09:40:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GEHsu](https://avatars.discourse-cdn.com/v4/letter/g/c2a13f/32.png) [@GEHsu](https://discuss.elastic.co/u/GEHsu)\
**Post date:** [October 18, 2022, 9:40am UTC](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870/1 "2022-10-18T09:40:34Z")

</div>

I tried paloalto (TRAFFIC/THREAT) 2 kinds of logs. Build to a different index.

Below is my Logstash config

```auto
input {
  syslog {
    port => "4560"
  }
}

filter {
  # Traffic Logs
  grok {
    match => { "message" => "%{DATA:future_use},%{DATA:ReceiveTime},%{DATA:Serial},(?<Type>TRAFFIC),%{DATA:ThreatType},%{DATA:future_use},%{DATA:GenerateTime},%{IP:SourceAddress},%{IP:DestinationAddress},%{DATA:NATSourceIP},%{DATA:NATDestinationIP},%{DATA:Rule},%{DATA:SourceUser},%{DATA:DestinationUser},%{DATA:Application},%{DATA:VirtualSystem},%{DATA:SourceZone},%{DATA:DestinationZone},%{DATA:InboundInterface},%{DATA:OutboundInterface},%{DATA:LogAction},%{DATA:TimeLogged},%{DATA:SessionID},%{DATA:RepeatCount},%{DATA:SourcePort},%{DATA:DestinationPort},%{DATA:NATSourcePort},%{DATA:NATDestinationPort},%{DATA:Flags},%{DATA:Protocol},%{DATA:Action},%{DATA:Bytes},%{DATA:BytesSent},%{DATA:BytesReceived},%{DATA:Packets},%{DATA:StartTime},%{DATA:ElapsedTime},%{DATA:Category},%{DATA:future_use},%{DATA:Serial},%{DATA:ActionFlags},%{DATA:SourceCountry},%{DATA:DestinationCountry},%{DATA:future_use},%{DATA:PacketsSent},%{DATA:PacketsReceived},%{DATA:SessionEndReason}," }
        remove_field => ["future_use", "Serial", "GenerateTime"]
    }
  # Threat Logs
  grok {
    match => { "message" => "%{DATA:future_use},%{DATA:ReceiveTime},%{DATA:Serial},(?<Type>THREAT),%{DATA:ThreatType},%{DATA:future_use},%{DATA:GenerateTime},%{IP:SourceAddress},%{IP:DestinationAddress},%{DATA:NATSourceIP},%{DATA:NATDestinationIP},%{DATA:Rule},%{DATA:SourceUser},%{DATA:DestinationUser},%{DATA:Application},%{DATA:VirtualSystem},%{DATA:SourceZone},%{DATA:DestinationZone},%{DATA:InboundInterface},%{DATA:OutboundInterface},%{DATA:LogAction},%{DATA:TimeLogged},%{DATA:SessionID},%{DATA:RepeatCount},%{DATA:SourcePort},%{DATA:DestinationPort},%{DATA:NATSourcePort},%{DATA:NATDestinationPort},%{DATA:Flags},%{DATA:Protocol},%{DATA:Action},%{DATA:URL_Filename},%{DATA:ThreatID},%{DATA:Category},%{DATA:Severity},%{DATA:Direction},%{DATA:SequenceNumber},%{DATA:ActionFlags},%{DATA:SourceCountry},%{DATA:DestinationCountry}," }
        remove_field => ["future_use", "Serial", "GenerateTime", "SequenceNumber"]
    }
  # URL Log
# grok {
# match => { "message" => "%{DATA:future_use},%{DATA:ReceiveTime},%{DATA:Serial},(?<Type>THREAT),(?<ThreatType>url),%{DATA:future_use},%{DATA:GenerateTime},%{IP:SourceAddress},%{IP:DestinationAddress},%{DATA:NATSourceIP},%{DATA:NATDestinationIP},%{DATA:Rule},%{DATA:SourceUser},%{DATA:DestinationUser},%{DATA:Application},%{DATA:VirtualSystem},%{DATA:SourceZone},%{DATA:DestinationZone},%{DATA:InboundInterface},%{DATA:OutboundInterface},%{DATA:LogAction},%{DATA:TimeLogged},%{DATA:SessionID},%{DATA:RepeatCount},%{DATA:SourcePort},%{DATA:DestinationPort},%{DATA:NATSourcePort},%{DATA:NATDestinationPort},%{DATA:Flags},%{DATA:Protocol},%{DATA:Action},%{DATA:URL_Filename},%{DATA:ThreatID},%{DATA:Category},%{DATA:Severity},%{DATA:Direction},%{DATA:SequenceNumber},%{DATA:ActionFlags},%{DATA:SourceCountry},%{DATA:DestinationCountry}," }
# remove_field => ["future_use", "Serial", "GenerateTime", "SequenceNumber"]
# }
 #vulnerability Logs
# grok {
# match => { "message" => "%{DATA:future_use},%{DATA:ReceiveTime},%{DATA:Serial},(?<Type>THREAT),(?<ThreatType>vulnerability),%{DATA:future_use},%{DATA:GenerateTime},%{IP:SourceAddress},%{IP:DestinationAddress},%{DATA:NATSourceIP},%{DATA:NATDestinationIP},%{DATA:Rule},%{DATA:SourceUser},%{DATA:DestinationUser},%{DATA:Application},%{DATA:VirtualSystem},%{DATA:SourceZone},%{DATA:DestinationZone},%{DATA:InboundInterface},%{DATA:OutboundInterface},%{DATA:LogAction},%{DATA:TimeLogged},%{DATA:SessionID},%{DATA:RepeatCount},%{DATA:SourcePort},%{DATA:DestinationPort},%{DATA:NATSourcePort},%{DATA:NATDestinationPort},%{DATA:Flags},%{DATA:Protocol},%{DATA:Action},%{DATA:URL_Filename},%{DATA:ThreatID},%{DATA:Category},%{DATA:Severity},%{DATA:Direction},%{DATA:SequenceNumber},%{DATA:ActionFlags},%{DATA:SourceCountry},%{DATA:DestinationCountry}," }
# remove_field => ["future_use", "Serial", "GenerateTime", "SequenceNumber"]
# }
}
output {
if [Type] == "TRAFFIC" {
   elasticsearch {
     hosts => ["localhost:9200"]
     index => "traffic_logs-%{+YYYY.MM.dd}"
     }
   }
else if [Type] == "THREAT" {
   elasticsearch {
     hosts => ["localhost:9200"]
     index => "threat_logs-%{+YYYY.MM.dd}"
     }
   }
#if [Type] == "THREAT" and [ThreatType] == url {
# elasticsearch {
# hosts => ["localhost:9200"]
# index => "url_logs-%{+YYYY.MM.dd}"
# }
# }
#if [Type] == "THREAT" and [ThreatType] == vulnerability {
# elasticsearch {
# hosts => ["localhost:9200"]
# index => "vulnerability_logs-%{+YYYY.MM.dd}"
# }
# }

}

```

I originally wanted to create a different index for TRAFFIC logs/THREAT logs/THREAT logs ThreatType:url/THREAT logs ThreatType:vulnerability

Tried a variety of settings. Use the check command to show OK. But there is no data input to elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2022, 9:41am UTC](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870/2 "2022-11-15T09:41:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.