Sending logs to OpenSearch using panos parser produces JSON error in OpenSearch about syslog-ng

[MrAnno]

Hi @xamor,

Could you share your input/output on which syslog-ng produces an invalid JSON?

With my test inputs, the output is perfectly valid:

{
  "panos": {
    "vsys_name": "",
    "vsys": "",
    "type": "SYSTEM",
    "time_generated": "2020/04/14 16:48:54",
    "subtype": "auth",
    "severity": "medium",
    "serial": "unknown",
    "seqno": "1718",
    "receive_time": "2020/04/14 16:48:54",
    "opaque": "failed authentication for user \\'admin\\'. Reason: Invalid username/password. From: 10.0.10.55.",
    "object": "",
    "module": "general",
    "future_use4": "0",
    "future_use3": "0",
    "future_use2": "0",
    "future_use1": "1",
    "eventid": "auth-fail",
    "dg_hier_level_4": "0",
    "dg_hier_level_3": "0",
    "dg_hier_level_2": "0",
    "dg_hier_level_1": "0",
    "device_name": "paloalto",
    "actionflags": "0x0"
  },
  "TRANSPORT": "local+stdin",
  "SOURCE": "#anon-source0",
  "PROGRAM": "paloalto_panos",
  "PRIORITY": "warning",
  "MSGFORMAT": "rfc3164",
  "MESSAGE": "1,2020/04/14 16:48:54,unknown,SYSTEM,auth,0,2020/04/14 16:48:54,,auth-fail,,0,0,general,medium,failed authentication for user \\'admin\\'. Reason: Invalid username/password. From: 10.0.10.55.,1718,0x0,0,0,0,0,,paloalto",
  "ISODATE": "2024-04-14T16:48:54+02:00",
  "HOST_FROM": "AnnoW",
  "HOST": "AnnoW",
  "FILE_NAME": "-",
  "FACILITY": "user",
  "@timestamp": "2024-04-14T16:48:54+02:00"
}

[xamor]

I think there was a Problem in OpenSearch. It is now fixed, it was a bit wired because only the the panos output of syslog-ng seemed to produce the error but cisco was working.

Some others had similar issues with OpenSearch and Prometheus.