You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Panos devices can send logs in RFC5424 (newer syslog) format, but the module is hardcoded to rfc3164 (older syslog).
Currently the only workaround is to edit the module/panw/panos/config/input.yml file and enable the new RFC with the format config option for syslog input (added by #23954):
We're currently working on RFC5424 support for the Palo Alto and all firewall integrations. Closing this issue in favour of the issue we're working on here: elastic/integrations#1878
Panos devices can send logs in RFC5424 (newer syslog) format, but the module is hardcoded to rfc3164 (older syslog).
Currently the only workaround is to edit the
module/panw/panos/config/input.yml
file and enable the new RFC with theformat
config option for syslog input (added by #23954):type: syslog + format: 5424 protocol.udp: host: "{{.syslog_host}}:{{.syslog_port}}"
We should expose this configuration via a module setting or update the panw module to do it's own syslog parsing supporting both RFCs.
The text was updated successfully, but these errors were encountered: