search

elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
187 stars 391 forks source link

[Juniper SRX] Syslog messages #10094

Open daniterras opened 4 weeks ago

daniterras commented 4 weeks ago

Kibana version: 8.13.3 Elasticsearch version: 8.13.3

The following error message appears:

error.messageProcessor "grok" with tag "" in pipeline "logs-juniper_srx.log-1.21.0" failed with message "Provided Grok expressions do not match field value: [<101>Jun 6 15:18:03 host01 xntpd[2130]: kernel time sync enabled 2001]"

The pipeline for the Junos SRX integration (version 1.21.0) is failing to interpret the messages correctly.

elasticmachine commented 3 weeks ago

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

pkoutsovasilis commented 3 weeks ago

Hello @daniterras , as mentioned in the documentation of the Juniper SRX, only the format "structured-data + brief" is supported. As far as I can tell, the log line that you reported <101>Jun 6 15:18:03 host01 xntpd[2130]: kernel time sync enabled 2001] is not following this format. Can you switch the log messages format to the supported one?