Panw module (Palo Alto) ingest reports Object Object.getClass() error because receiver is null

Elastic Security SIEM
1

I am seeing errors for some of the TRAFFIC entries in the log.
Pipeline complains about:
Object Object.getClass() because receiver is null

After breaking down the csv I found the following fields 12,13,19 were null in cases where the pipeline failed.

These are mapped while parsing TRAFFIC to:
client.user.name: 12
source.user.name: 12
server.user.name: 13
destination.user.name: 13
panw.panos.destination.interface: 19
observer.ingress.interface.name: 19

Is this a know issue?
is there a solution for this?

Thanks in advance for your help.

2

(Moving post to SIEM category as that team at Elastic maintains this module)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.