How to Enable Filebeat Stream to a Logstash Pipeline
The Barracuda CloudGen Firewall allows you to stream event logs from Firewall Insights to a Logstash server, which provides information on firewall activity, threat logs, and information related to network, version, and location of managed firewall units. To receive Filebeat data streams through the Logstash pipeline, enable debugging and syslog streaming, and configure the firewall to send data to a Logstash server. Streaming logs from Firewall Insights through the Logstash pipeline requires a Firewall Insights license.
Enable Stream to Logstash Pipeline
Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.
In the Configuration menu on the left, select Firewall Insights.
Expand the Configuration Mode menu and select Switch to Advanced.
Click Lock.
Enable the service and select Use Generic Logstash.
Enter the IP address or host name that points to your Logstash pipeline.
Click Send Changes and Activate.
Default Logstash Configuration File
To receive and forward all events through your Logstash pipeline, use the following configuration. Make sure to use the PKSCS8 certificate key.
File beat Conifg: /log/logstash-cgf.conf
<code>
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/ssl/cert.pem"
ssl_key => "/etc/ssl/key.pkcs8"
}
}
filter {
json {
source => "message"
target => "message"
}
}
output {
stdout { codec => rubydebug }
}
</code>Firewall Activity Messages
(for Firewall Insights, type = ngfw-act)
JSON Fields
Field Name | Description | Datatype | Optional | Null Value |
|---|---|---|---|---|
timestamp | Time stamp in seconds since epoch | int | no | - |
version | Message format version. Currently 1. | int | no | - |
action | Firewall Action:
| string | no | - |
duration | Duration of the session in milliseconds | int | no | - |
src_iface | source interface name (e.g. "eth0") | string | yes | key is not in JSON |
src_ip | source IP | string | no | - |
src_ip_nat | source IP after NAT | string | yes | “0.0.0.0” |
src_port | source port or session identifier for protocols without ports (e.g., ICMP) | int | yes | key is not in JSON |
src_port_nat | source port after NAT (Added in firmware 10.5.0) | int | yes | key is not in json |
src_mac | source mac address | string | yes | "00:00:00:00:00:00" |
dst_iface | destination interface name | string | yes | key is not in JSON |
dst_ip | destination IP | string | no | - |
dst_ip_nat | destination IP after NAT | string | yes | “0.0.0.0” |
dst_port | destination port or session identifier for protocols without ports (e.g. ICMP) | int | yes | key is not in JSON |
dst_port_nat | destination port after NAT (Added in firmware 10.5.0) | string | yes | key is not in JSON
|
dst_mac | destination mac address | string | yes | "00:00:00:00:00:00" |
fwd_bytes | number of bytes sent in the sessions's forward direction | int | yes | key is not in JSON
|
rev_bytes | number of bytes sent in the sessions's reverse direction | int | yes | key is not in JSON
|
fwd_packets | number of packets sent in the sessions's forward direction | int | yes | key is not in JSON
|
rev_packets | number of packets sent in the sessions's reverse direction | int | yes | key is not in JSON
|
user | username | string | yes | key is not in JSON
|
tunnel | tunnel name | string | yes | key is not in JSON
|
ip_proto | numeric ip protocol id (see https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers) | int | no |
|
protos | detected application protocols, from most specific to least specific (e.g. ["HTTPS direct", "HTTPS", "All HTTP protocols"] | array of strings | yes | key is not in JSON
|
contents | detected content types, from most specific to least specific (e.g. [ "HTML", "Web Files"] | array of strings | yes | key is not in JSON
|
apps | array of detected applications, from most specific to least specific (e.g. ["Google Services Base","Google Services"] | array of strings | yes | key is not in JSON
|
policy_sdwan | SD-WAN Policy (Added in firmware 10.5.0) | strings | yes | key is not in JSON
|
policy_rac | Zero Trust Access Policy (Added in firmware 10.5.0) | string | yes | key is not in JSON
|
policy_icmp | ICMP Policy (Added in firmware 10.5.0) | string | yes | key is not in JSON
|
policy_tls | TLS Inspection Policy (Added in firmware 10.5.0) | string | yes | key is not in json |
policy_av | Malware Protection Policy (Added in firmware 10.5.0) | string | yes | key is not in json
|
policy_ips | IPS Policy (Added in firmware 10.5.0) | string | yes | key is not in json
|
policy_app | Applications Policy (Added in firmware 10.5.0) | string | yes | key is not in json
|
policy_urlcat | URL Filtering Policy (Added in firmware 10.5.0) | string | yes | key is not in json
|
policy_agent | User Agent Policy (Added in firmware 10.5.0) | string | yes | key is not in json
|
policy_content | File Content Policy (Added in firmware 10.5.0) | string | yes | key is not in json
|
domain
| The "Referer" request header field if set or the host part of the request URI otherwise (Added in firmware 10.5.0)
| string
| yes
| key is not in JSON
|
fw_rule | firewall rule name | string | yes | key is not in JSON |
app_rule | application rule name (e.g. "<App>:ALL-APPS") | string | yes | key is not in JSON
|
fw_info | Detailed information about the action performed by the firewall (There are 7 categories.): 1. Generic/Normal Operation (0 - 999)
10. Failed (1000 - 1999)
54. Terminated (2000 - 2999)
88. Packet Dropped (3000 - 3999)
|