# Sentinelone parsing Issue

**URL:** <https://discuss.elastic.co/t/sentinelone-parsing-issue/381897>\
**Category:** Logstash\
**Created:** [September 12, 2025, 8:50am UTC](https://discuss.elastic.co/t/sentinelone-parsing-issue/381897 "2025-09-12T08:50:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahesh\_Loke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_loke/32/142563_2.png) [@Mahesh\_Loke](https://discuss.elastic.co/u/Mahesh_Loke)\
**Post date:** [September 12, 2025, 8:50am UTC](https://discuss.elastic.co/t/sentinelone-parsing-issue/381897/1 "2025-09-12T08:50:31Z")

</div>

I have integrated sentinelone with elk via logstash, logs are coming but unparsed

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 12, 2025, 1:41pm UTC](https://discuss.elastic.co/t/sentinelone-parsing-issue/381897/2 "2025-09-12T13:41:33Z")

</div>

Hello and welcome,

What you configured? Did you create a logstash configuration to parse your messages? When using logstash you need a configuration, nothing gets parsed automatically.

Please share what you configured, where and how.

---

<div class="post-metadata">

**Author:** ![Mahesh\_Loke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_loke/32/142563_2.png) [@Mahesh\_Loke](https://discuss.elastic.co/u/Mahesh_Loke)\
**Post date:** [September 15, 2025, 12:20pm UTC](https://discuss.elastic.co/t/sentinelone-parsing-issue/381897/3 "2025-09-15T12:20:02Z")

</div>

Hello ,

Actually I have done It via API using fleet but logs are unparsed, not via logstash