# Schema Bug in Filebeat panw Module **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-security, filebeat\ **Created:** [August 2, 2019, 2:51pm UTC](https://discuss.elastic.co/t/schema-bug-in-filebeat-panw-module/193569 "2019-08-02T14:51:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![learnitall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/learnitall/32/51531_2.png) [@learnitall](https://discuss.elastic.co/u/learnitall)\ **Post date:** [August 2, 2019, 2:51pm UTC](https://discuss.elastic.co/t/schema-bug-in-filebeat-panw-module/193569/1 "2019-08-02T14:51:05Z")
Greetings! Hope all is well. I've been testing out the [Palo Alto](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-panw.html) module on Filebeat version 7.2.1 with some of our internal PAN-OS Traffic and Threat syslogs. I believe I found a bug in the Threat schema. In the Filebeat module, Source Location and Destination Location fields for Threat syslogs are being piped directly into `source.geo.country_iso_code` and `destination.geo.country_iso_code`, which can be seen in [beats/x-pack/filebeat/module/panw/panos/config/input.yml](https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/panw/panos/config/input.yml) on the beats Github repo, lines 133 and 134. According to the [PAN-OS documentation](https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/syslog-field-descriptions) however, the Source Location and Destination Location fields for threat logs can also contain "Internal region for private addresses". This means that in our ES cluster we can see Threat syslog events from the panw module where `source/destination.country_iso_code` is set to a private IP range, such as `192.168.0.0-192.168.255.255`. This impacts us negatively because we have to filter out private subnets when creating region maps for our threat syslogs (i.e. `not destination.geo.country_iso_code:"192.168.0.0-192.168.255.255" and not destination.geo.country_iso_code...`). If possible, we'd like for the `country_iso_code` field to only be populated with actual country ISO codes, to prevent confusion and for the sake of consistency. Thanks! ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [August 16, 2019, 2:21pm UTC](https://discuss.elastic.co/t/schema-bug-in-filebeat-panw-module/193569/2 "2019-08-16T14:21:55Z")
Hi there, I went ahead and opened an issue on your behalf in [https://github.com/elastic/beats/issues/13272](https://github.com/elastic/beats/issues/13272). You can track the progress there. ---
**Author:** ![learnitall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/learnitall/32/51531_2.png) [@learnitall](https://discuss.elastic.co/u/learnitall)\ **Post date:** [August 16, 2019, 8:19pm UTC](https://discuss.elastic.co/t/schema-bug-in-filebeat-panw-module/193569/3 "2019-08-16T20:19:56Z")
Awesome sounds good- thank you! In the future, should I report issues like these straight onto the repository? Or continue to create a post in the forum first? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [August 17, 2019, 11:35am UTC](https://discuss.elastic.co/t/schema-bug-in-filebeat-panw-module/193569/4 "2019-08-17T11:35:20Z")
If you're certain it is a bug you can go ahead and open it directly on the repository. Otherwise, we can always discuss it here first and either give you feedback so that you can open it yourself or open it on your behalf. Cheers ! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2019, 11:35am UTC](https://discuss.elastic.co/t/schema-bug-in-filebeat-panw-module/193569/5 "2019-09-14T11:35:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.