Namaste Team,
I'm not sure what is wrong with my code, but I am getting the following error while populating the intermediary nat IP address.
Error: generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"read_only_udm\\": index 0: recursive rawDataToProto failed: field \\"intermediary_nat\\": no descriptor found"
Code I have written:
if [_collector_internal_ip_address] not in [ "","-" ] {
grok {
match => {
"_collector_internal_ip_address" => [ "%{IP:natip}" ]
}
overwrite => ["natip"]
on_error => "not_valid_natip"
}
}
if ![not_valid_natip] {
mutate {
merge => {
"event.idm.read_only_udm.intermediary_nat.ip" => "natip"
}
}
}
Let me know what I am doing wrong here.
Thanks,
Indrajeet Deshmukh
Let me know what I am doing wrong here.
Thanks,
Indrajeet Deshmukh