# Panw Schema Potential Bug in CSV Parse and Column Numbering **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 15, 2019, 3:34pm UTC](https://discuss.elastic.co/t/panw-schema-potential-bug-in-csv-parse-and-column-numbering/208099 "2019-11-15T15:34:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![davidhowell.tx](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@davidhowell.tx](https://discuss.elastic.co/u/davidhowell.tx)\ **Post date:** [November 15, 2019, 3:34pm UTC](https://discuss.elastic.co/t/panw-schema-potential-bug-in-csv-parse-and-column-numbering/208099/1 "2019-11-15T15:34:30Z")
I'm unable to determine if this bug is manifesting in actual Filebeat parses of PAN-OS logs as I'm not utilizing them. I'm using the Filebeat configuration to assist in creating my Logstash pipeline to map PAN-OS fields to Elastic Common Schema. During my review the first thing I notice is that the Filebeat panw module has the csv parse column 1 to "event.created". Upon reviewing Palo Alto's documentation on the field descriptions, the first column presented is labeled "FUTURE\_USE", and the second column is "Receive Time". If the panw module is parsing properly it suggests that the module is somehow skipping the first column, which would be sufficient for the panw stance of dropping many of the fields including those marked for "future use", but I'm hesitant to drop fields that could be used in the future for use cases currently unknown. References: - [PANW Filebeat Module](https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/panw/panos/config/input.yml) - [PAN-OS 7.1 Traffic Log Fields](https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html#ide7d8511f-7bd4-490b-a9b2-b5be12b1e9f2) - [PAN-OS 7.1 Threat Log Fields](https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields.html) ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [November 15, 2019, 4:15pm UTC](https://discuss.elastic.co/t/panw-schema-potential-bug-in-csv-parse-and-column-numbering/208099/2 "2019-11-15T16:15:23Z")
It might be related to your Pan-os version. > This module has been tested with logs generated by devices running PAN-OS versions 7.1 to 9.0 but limited compatibility is expected for earlier versions. See [Palo Alto Networks module | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-panw.html#_compatibility_22) What's your current version? ---
**Author:** ![davidhowell.tx](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@davidhowell.tx](https://discuss.elastic.co/u/davidhowell.tx)\ **Post date:** [November 15, 2019, 5:11pm UTC](https://discuss.elastic.co/t/panw-schema-potential-bug-in-csv-parse-and-column-numbering/208099/3 "2019-11-15T17:11:53Z")
Currently 8.1. The 1st column is highlighted as "FUTURE\_USE" in each of the major versions currently supported. Note the section labeled "Format:" with a comma-separated list of fields found in the forwarded log. If it has been tested on these versions, then I'm assuming this first field is being dropped somewhere before the log reaches filebeat so this is probably a non-issue. - [PAN-OS 7.1 Traffic Log Fields](https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html#ide7d8511f-7bd4-490b-a9b2-b5be12b1e9f2) - [PAN-OS 8.1 Traffic Log Fields](https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html#ide7d8511f-7bd4-490b-a9b2-b5be12b1e9f2) - [PAN-OS 9.0 Traffic Log Fields](https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html#ide7d8511f-7bd4-490b-a9b2-b5be12b1e9f2) ---
**Author:** ![davidhowell.tx](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@davidhowell.tx](https://discuss.elastic.co/u/davidhowell.tx)\ **Post date:** [November 15, 2019, 5:14pm UTC](https://discuss.elastic.co/t/panw-schema-potential-bug-in-csv-parse-and-column-numbering/208099/4 "2019-11-15T17:14:51Z")
Note, I'm using Panorama's Log Forwarding Profile to send directly to Logstash. It comes in as Syslog RFC5424, and after using grok to parse the syslog fields, then passing the remaining message field to the logstash csv filter I do have a value present before the "Receive Time" field on all log types I've parsed including Traffic, Threat, User-ID, and System. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 13, 2019, 5:21pm UTC](https://discuss.elastic.co/t/panw-schema-potential-bug-in-csv-parse-and-column-numbering/208099/5 "2019-12-13T17:21:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.