This is my fix for the parser, please try this one.In general ; 1. You did not escape the characters "[" and "]" properly, you would need to test the parsre in Chronicle SIEM parser after testing in GROK debugger as there are some differences.2. Some...

Please try this parser, it should parse your fields like this ; # Product: HAPROXY # Category: Load balancing # Supported Format: SYSLOG # Reference: N/A # Last Updated: 2024-07-22 filter { mutate { replace => { "syslog_timestamp" => "" "process" => ...

Hi @ziobill ,The first problems I noticed are ;1. #on_error => "match_error" , you are using this tag in the next line so you need to un-comment this line.2. Many of the "replace" statements should not be used with the repeated UDM fields like event....

Hi @cahehay553 ,The options I know are ;1. You could configure your ETL tools to push the logs to GCP/S3 buckets -among other options- that Chronicle could ingest from, the list of Chronicle-supported feeds are listed here.https://cloud.google.com/ch...