hello everyone , Please I am stuck in the “log normalization” step , logs of firewall Palo alto , I read on the documentation of graylog, to standardize the logs one uses “extractor” . : Copy input, Grok pattern, Json, Regular expression, repleace with regular expression, Split & Index, Substring,…

For Palo Alto I’d recommend a Grok pattern, but regex and split&index also would work… There are some content pack options in the Marketplace you might be able to look at too such as https://marketplace.graylog.org/addons/f9facfdf-3d3d-423d-9bd0-4fba9db407ff (search the marketplace for more options…

[image] LMGTFY LMGTFY You can also find grok pattern testes/debuggers.

@macko003 I have already searched, thank you for your great efforts… thanks God because there are people like you @macko003

I import content pack options in the Marketplace [content%20packs] Now in Inputs : i have PAN-syslog Syslog TCP i changed his port , to 1514, it’s his default port [pan] but I have not received any logs yet, maybe i keep his default port, and reconfigure the palo alto to send in tcp and the …

hello everone, please I import content pack Palo Alto Networks Content Pack, i use Graylog 2.5, my firewall palo Alto A820, Pan 8,0.9. this pack it is adequate with graylog 2.5 ?? Graylog Graylog [syslog] Now , i import this pack Graylog Graylo…

yes i did it :heart_eyes::heart_eyes: I did the normalization of alto palo logs, now, I have the standardized alto palo logs

@macko003 yes i did it :sweat_smile::sweat_smile: I did the normalization of my FW palo alto logs, now, I have the standardized palo alto logs with graylog 2.5… the logs are not like before, now they are very clear

fantastic what can do some time what you spend with testing and searching. I think this project not more than few hours with work. You opened this topic 7 days before.

@macko003 Maybe you’re right but it’s not nice of you, for the work I don’t have only Graylog…and for a beginner like me it’s not bad … in any case thank you

Log normalization

Graylog Central (peer support)

Labidi (Ayoub) May 6, 2019, 6:49am 3

Hi @megan201296 thank you for your reply., Grok pattern " Grok" ? please “grok” what does that mean, exactly? in my case how can I configure it according to my equipment Palo alto A 820 ,

Topic		Replies	Views
FW Palo alto Logs Graylog Central (peer support)	29	3066	May 27, 2019
Palo Alto Content Pack on Market Place Graylog Add-ons	3	1534	August 18, 2017
Old content pack import failed in graylog 4.3 Graylog Central (peer support)	21	1070	January 19, 2023
Ideas for GROK pattern, problem: URL containing separators Graylog Central (peer support)	14	2457	February 20, 2020
Unable to Import Palo Alto Networks Content Packs Graylog Add-ons pipeline-rules , route-to-streampl	12	4315	May 26, 2020

Log normalization

Related topics