Support for Sonicwall firewall?

[ajwilliamson]

Can anyone offer any tips on getting Sonicwall syslogs to work properly?

I receive data but comes into NLS tagged with "_grokparsefailure_sysloginput".

Thanks

[cdienger]

I found option at https://github.com/jdnow/Logstash-Confi ... l.conf#L24.

First create an input under Configure > Global (All Instances) > Global Config, with this configuration:

Code: Select all

syslog {
    type => Sonicwall
    port => 5514
}

Next, create a filter with:

Code: Select all

 if [type] == "Sonicwall" {
                kv {
                        exclude_keys => [ "c", "id", "m", "n", "pri", "proto" ]
                }
                grok {
                        match => [ "src", "%{IP:srcip}:%{DATA:srcinfo}" ]
                }
                grok {
                        match => [ "dst", "%{IP:dstip}:%{DATA:dstinfo}" ]
                }
                grok {
                        remove_field => [ "srcinfo", "dstinfo" ]
                }
        geoip {
                add_tag => [ "geoip" ]
                source => "srcip"
        }
}

After applying the configuration, configure the Sonicwall to send logs to port 5514 and it will go through this input and filter.