How to configure BasicPaloAltoFirewallParser/any java parser to Metron Topology

bharath_phatak — Thu, 27 Jul 2017 20:07:17 GMT

Hi All,

I am followed the steps mentioned in below link and setup SQUID topology. The logs are getting enriched and indexed and visible in Kibana.

Now i need to add BasicPaloAltoFirewallParser(Paloalto topology). Below is config json file.

{

"parserClassName":"org.apache.metron.parsers.paloalto.BasicPaloAltoFirewallParser",

"sensorTopic":"newPalto",

"parserConfig": { "timestampField": "timestamp" }

}

I dont see any errors, but the logs are not pushed into "enrichments" topic

Any help would be much appreciated.

Thanks

Re: How to configure BasicPaloAltoFirewallParser/any java parser to Metron Topology

bharath_phatak — Thu, 03 Aug 2017 15:34:00 GMT

The issue was with logs which i was using. When i injected full logs from Paloalto firewall, the logs were being parsed, enriched and indexed.

Hopefully this will be helpfull for others.

Thanks,

Bharath