inputs.conf for PAN app when collecting from syslog server

[JSapienza]

We already have the pan devices logging to our syslog-ng server. I have deployed the the following inputs.conf to the forwarder:

# syslog forwarder inputs
  [monitor:///var/log/syslog/PaloAlto/]
  host_segment = 5
  index = pan_logs
  sourcetype = pan_log
  blacklist = \.(gz|bz2)$

Data is hitting the pan_logs index however none of the dashboards are populating. After looking at some of the searched I noticed other pan sourcetypes that are not being populated. I assume these are supposed to be rewritten at index time? . All data in the pan_logs index is sourcetype = pan_log. Any ideas ?

[btorresgil]

Hello,

If the logs are coming in as sourcetype=pan_log, then that is usually due to a parsing issue because it is supposed to parse the logs and separate them into different sourcetypes. Typically it can't parse the logs because they have been changed in some way from their original default format. Check that you aren't using a custom log format on the firewall, and that your syslog-ng server isn't changing the logs so that the parser can't determine the correct sourcetype for each log.

-Brian

[JSapienza]

Thanks Brian, So I should not explicitly set the sourcetype in the monitor stanza ?