The issue was with logs which i was using. When i injected full logs from Paloalto firewall, the logs were being parsed, enriched and indexed. Hopefully this will be helpfull for others. Thanks, Bharath ... View more