Skip to content

Palo Alto | include "strict_date_optional_time_nanos" format for date fields #26033

@jamiehynds

Description

@jamiehynds

Logs that are generated from Palo Alto's Cortex Data Lake default to using the date format strict_date_optional_time_nanos, while the panw-panos-pipeline currently defaults to using the following date format:

"formats": [
    "yyyy/MM/dd HH:mm:ss"
 ],

Adding 'strict_date_optional_time_nanos' as a default date format for the filebeat panw-panos-pipeline will also users to ingest data from Palo Alto's Cortex Data Lake without manually modifying the pipeline. This format has been tested by a user:

"formats": [
        "yyyy/MM/dd HH:mm:ss",
        "strict_date_optional_time_nanos"
      ],

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions