Describe the issue:
Azure firewall logs seem to skip the ingest pipeline that parses out fields
It's possible grok patterns are missing from logs-azure.firewall_logs-1.8.3 ingest pipeline
Log Categories:
- AZFWDnsQuery
- AZFWNatRule
- AZFWNetworkRule
- AZFWApplicationRule
Example messages from event.original:
Network Rule:
Application Rule:
From initial look, looks like the pipeline uses grok processor on "json.properties.msg" but these example events don't contain nested msg:
Describe the issue:
Azure firewall logs seem to skip the ingest pipeline that parses out fields
It's possible grok patterns are missing from logs-azure.firewall_logs-1.8.3 ingest pipeline
Log Categories:
Example messages from event.original:
Network Rule:
Application Rule:
From initial look, looks like the pipeline uses grok processor on "json.properties.msg" but these example events don't contain nested msg:
