Dell SonicWall Firewall

[faen]

Sonicwall Pipeline Rules

Really looks like this part is just skipped rule "Sonicwall Split IP Port Interface for src" when has_field("src") then set_fields( fields: grok( pattern:"%{IPV4:SrcIP}:%{INT:SrcPort}:%{GREEDYDATA:SrcInterface}", value: to_string($message.src) ) ); end [image] Does this look right? Should I separate Dst From Src maybe? EDIT: Yep I split and it seems to work @faen Are you using GL5? I’m trying …