Sophos integration with elastic agent v 8.9.1

[Ahmad_Shrateh]

I working on integrating Sophos firewall via UDP --> screenshot attached
I'm receiving the logs perfectly but I had an issue with no correct parsing of the data, and since all the log details are on the same field and the dashboard not getting the information correctly -- > screenshot attached.

elastic v 8.9.1
fleet server with elastic agent

any assistance

[chemamartinez]

Hi @Ahmad_Shrateh,

Sorry for the late response.

It looks like an error in the integration's pipeline while decoding the events. Is this happening with every Sophos log that the integration receives? or with a particular type of log?

It would be very helpful if you provide the log(s) that are not being parsed as expected (please replace any sensitive data) so we can reproduce the issue and apply a fix.

Thanks!