Hello friends, I come from here asking for help from experts. I have two firewalls with “syslog/udp” configured. Sophos19 and FortNet7.2 I realized that when FortNet received the logs, it was not necessary to configure extractors to get the fields all separated in an organized way. However, Soph…

Hello, @s0p4L1N Grateful! With a little modification I was able to resolve both Sohpos syslog issues: rule "Firewall Syslog Parser" when has_field("message") and contains(to_string($message.message),"device_name=\"SFW\"") and from_input(id:"64d658ba5c1b4b3b03d8741f") == true then set_fiel…

A pipeline with the key value function should work less on that data i would think. Key Value Parser Delivers Useful Information Fast

Here’s the pipeline rule that should work, it works for my firewall that give the same message type. rule "Firewall Syslog Parser" when has_field("message") then set_fields( fields: key_value( value: to_string($message.message), trim_value_chars: "\"", trim_key_chars:"", …

Ya that should work. What output do you get, does it do nothing at all? Have you looked in server.log for any errors?

[image] Joel_Duffield: A pipeline with the key value function should work less on that data i would think. Key Value Parser Delivers Useful Information Fast Grateful @Joel_Duffield This was the way I needed to get to the solution.

Thank you @s0p4L1N With the change you made in the pipeline component, it can bring me a faster understanding of the work it does

[image] Joel_Duffield: Ya that should work. What output do you get, does it do nothing at all? Have you looked in server.log for any errors? Yes @Joel_Duffield . Before this post I looked for error messages in the graylog subsystem log. I even changed it to “errors” and “debug” to see if it e…

In fact it seems to be a problem with the Sophos syslog “timestamp” format.

Ya the timestamp probably isn’t compliant. There MAY be a setting on the sophos to pick between two syslog formats (some firewalls have this). If not, the timestamp is a normal field and you can set it in the pipeline, and there are several date parsing functions to help, you could either read the t…

True @Joel_Duffield From what I understand, this is expected: 2023-09-08 00:11:47.409 First situation: Sophos sends a field called “timestamp” which tries to overwrite the graylog’s “timestamp” field. Therefore, this field is left out and the parse does not occur. Who knows, just renaming this…

Ya I would read date and time into variables, use the timezone to change that time if needed to like utc, and then use those variables in a set_field of the timestamp field.

Syslog format does not follow recommendation

Graylog Central (peer support)

s0p4L1N (S0p4L1N) September 8, 2023, 12:33pm 17

@isotecviac2022 check this post: Rename Multiple Fields Using Pipeline Rule

1 Like

Topic		Replies	Views
Syslog message not being parsed when using Graylog Sidecar with filebeat input Graylog Central (peer support) sidecar , filebeat-linux	29	2544	September 1, 2022
Sophos UTM 9 extractors for standard syslog fields Other Solutions other_solutions	0	1112	March 26, 2022
Odd Pipeline/Stream Behavior Graylog Central (peer support)	10	528	January 19, 2024
How to correct syslog input that is missing timezone data? Graylog Central (peer support) pipeline-rules	3	1739	June 21, 2020
Sophos Firewall the NEW Marketplace content-pack	2	3733	January 24, 2024

Syslog format does not follow recommendation

Related topics