enotspe / fortinet-2-elasticsearch

Fortinet products logs to Elasticsearch
Apache License 2.0
86 stars 39 forks source link

Error on KV processor #60

Open enotspe opened 2 months ago

enotspe commented 2 months ago

This log fails to be parsed by kv processor

eventtime=1723216338424159701 tz="-0400" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=109.248.48.244 user="c\")" group="N/A" dst_host="N/A" reason="sslvpn_login_permission_denied" msg="SSL user failed to logged in" org="alexim"

because of the spcaed quotes on user value

user="c\")" 
enotspe commented 2 months ago

it does work on vector