# Parsing firewall logs in logstash

**URL:** https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786
**Category:** Logstash
**Created:** [December 22, 2019, 4:46pm UTC](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786 "2019-12-22T16:46:27Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 23, 2019, 2:58pm UTC](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786/2 "2019-12-23T14:58:24Z")

</div>

I would dissect and then kv

```
    dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{sourceHost} %{processName}[%{processId}]: %{[@metadata][restOfLine]}" } }
    date { match => ["[@metadata][timestamp]", "YYYY:MM:ss-HH:mm:ss" ] }
    kv { source => "[@metadata][restOfLine]" }
```

---

_[View the full topic](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786)._