PANW Integration 5.5.0 Receiving Palo Alto Logs but Not Indexing Events (Security Onion 3.3.0)

[sonuKenna]

Version

3.3.0

Installation Method

Cloud image (Amazon, Azure, Google)

Description

configuration

Installation Type

other (please provide detail below)

Location

cloud

Hardware Specs

Meets minimum requirements

CPU

NA

RAM

NA

Storage for /

NA

Storage for /nsm

NA

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Environment:

---

Security Onion: 3.3.0
Elastic Agent: 9.4.5
PANW Integration: 5.5.0
Deployment: Azure Cloud
Palo Alto Firewall Syslog -> Security Onion UDP/9001

Issue Summary:

---

Palo Alto logs are successfully reaching the Security Onion sensor but are not being indexed into the logs-panw.panos-default datastream.

The datastream count remains at 4 documents despite continuous live traffic from the firewall.

Troubleshooting Performed:

---

Initially identified that Palo Alto logs were not reaching Security Onion.
Fixed log forwarding and confirmed logs arrive on Security Onion.
Identified logs were being sent in CEF format.
Changed Palo Alto syslog format to the default PAN-OS CSV format.
Upgraded Security Onion from 3.0.0 to 3.3.0.
Upgraded Fleet / Elastic Agent from 9.3.x to 9.4.5.
Removed and reinstalled the Palo Alto Next-Gen Firewall integration.
Removed Internal Zones and External Zones for troubleshooting.
Restarted Elastic Agent.
Confirmed Fleet and Elastic Agent are healthy.
Confirmed Logstash is healthy.
Confirmed PANW integration is deployed and active.
Validation

PANW component exists:

---

Shell
sudo elastic-agent inspect components | grep -i panw

Output:
udp-so-manager_logstash-udp-panw-xxxxxxxx

---

UDP listener active:

Shell
sudo ss -lunp | grep 9001
 

Output:
*:9001
elastic-otel-collector

---

Live Palo Alto logs observed:

Shell
sudo tcpdump -ni any udp port 9001

Example received log:
<14>Oct 1 04:36:09 CLHQSL-PAN3.kmtl.com
1,2026/10/01 04:36:09,016401001105,TRAFFIC,end,...

Datastream Count
Shell
sudo so-elasticsearch-query
"logs-panw.panos-default/_count?pretty"

Result:

JSON
{
"count": 4
}

Count does not increase even while live traffic is arriving.

Errors Observed

Indexed documents show pipeline failures:

Plain Text
Processor 'conditional'
with tag 'set_network_direction_07647472'
 
cannot access method/field [zone]
from a null def reference

and

JSON
"event.kind": "pipeline_error"

---

Has anyone experienced this issue with:

---

Security Onion 3.3.0
PANW Integration 5.5.0
Palo Alto traffic logs in default CSV format

Since logs are reaching Security Onion and the PANW integration appears healthy, I am looking for guidance on whether this is a known issue with the PANW 5.5.0 ingest pipeline, additional debugging steps, or a recommended fix.

Thank you.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[sonuKenna]

Additional troubleshooting details:

• Palo Alto logs were initially not reaching Security Onion and this has been resolved.
• Palo Alto syslog format was changed from CEF to the default PAN-OS CSV format.
• Upgraded Security Onion from 3.0.0 to 3.3.0.
• Upgraded Elastic Agent/Fleet from 9.3.x to 9.4.5.
• Removed and reinstalled the Palo Alto Next-Gen Firewall integration.
• Removed Internal and External Zone mappings for testing.
• Restarted Elastic Agent.

Validation performed:

PANW component loaded:
sudo elastic-agent inspect components | grep -i panw

Output:
udp-so-manager_logstash-udp-panw-xxxxxxxx

UDP listener active:
sudo ss -lunp | grep 9001

Output:
*:9001 elastic-otel-collector

Live traffic confirmed:
sudo tcpdump -ni any udp port 9001

Example:
<14>Oct 1 04:36:09 CLHQSL-PAN3.kmtl.com
1,2026/10/01 04:36:09,016401001105,TRAFFIC,end,...

Datastream count:
sudo so-elasticsearch-query
"logs-panw.panos-default/_count?pretty"

Result:
{
"count" : 4
}

Observed pipeline error:

Processor 'conditional'
with tag 'set_network_direction_07647472'

cannot access method/field [zone]
from a null def reference

Question:
Has anyone seen this issue with PANW Integration 5.5.0 on Security Onion 3.3.0, where logs are received but never indexed?

[sonuKenna]

Kindly help me with the issue.

[reyesj2]

Can you provide a full sanitized log sample?

The integrations are managed by Elastic. I did a quick look through open issues, but didn't find anything that seemed directly related. https://github.com/elastic/integrations

Please note: #1720

Community Support is considered best effort and there are no guarantees and no SLAs. Please do not mark discussions as urgent. > If you need urgent, private, priority, or enterprise support, please consider purchasing support from Security Onion Solutions.