How to forward traffic (URL) to a syslog server?

[UNIVALI]

The $misc variable can only be used for Threats?

How to register the URL in syslog server?

CEF Key Name: request

Full Name: requestURL

Data Type: string

Length: 1024

Meaning: URL or filename for threat logs

Palo Alto Networks Value Field: $misc

from PANOS_6_0_CEF_Configuration

How to Forward Custom URL Logs to a Syslog Server

[gwesson]

URL logs are actually threat logs, listed as informational severity (as in the screenshot at the bottom of the page you linked). When you send the informational severity threat logs, that will contain the URL if you supply the $misc token.

-Greg