Log Parsing

Alex-Kushnarev — Tue, 14 Jan 2020 12:45:08 GMT

Hi team,

i am sending the firewall logs to a kibana for log analytic purpose and i ran into a minor issue i can not find a good working grok parsing for the logs that will actually work.

any chances any one here done that and can help me with it ?

Bets Regards,

Alex.

Re: Log Parsing

OtakarKlier — Tue, 14 Jan 2020 22:57:11 GMT

Hello,

What are you attempting to parse? Are you using ELK on the back end? Kibana is really only the web front end.

Please expand on your inquiry.

Regards,

Re: Log Parsing

michelealbrigo — Fri, 17 Jan 2020 09:43:27 GMT

As @OtakarKlier told you, the problem is outside Kibana, which is "just" a GUI over something else. Kibana gets its data from another place, usually ElasticSearch, which is "just" an indexed storage. Something else will put data into ES, and a common tool to do that is Logstash, which is where you configure all parsing operations.

For PANFW logs you'd generally use a CSV parser, rather than a Grok one, since the logs have a fixed structure and the CSV parser is much faster than the Grok one (more flexible). My configuration is quite complicated, but I think I've started from this tutorial: https://anderikistan.com/2016/03/26/elk-palo-alto-networks/

I doubt your Kibana gets its data from anything else than Elasticsearch, while your Elasticsearch might get its input from something different than Logstash: try to explore a CSV-style parser for your log processor of choice. Also, if possible, I recommend creating the proper mappings in your ES firewall indexes (i.e. an integer gets stored as an integer, an IP as an IP, and so on).

topic Re: Log Parsing in General Topics

Log Parsing

Re: Log Parsing

Re: Log Parsing