globalprotect_csv.json

{
  "input": {
    "message": "1,2020/12/08 14:30:55,011111114444,GLOBALPROTECT,0,2305,2020/12/08 13:30:55,vsys1,gw-auth,login,Other,,user,FR,AAAABBBBB,1.2.3.4,0.0.0.0,0.0.0.0,0.0.0.0,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeee,ABCDEFG,5.1.4,Windows,\"Microsoft Windows 10 Pro , 64-bit\",1,,,\"\",success,,0,user-logon,0,gw1,1234567,0x8000000000000000"
  },
  "expected": {
    "message": "1,2020/12/08 14:30:55,011111114444,GLOBALPROTECT,0,2305,2020/12/08 13:30:55,vsys1,gw-auth,login,Other,,user,FR,AAAABBBBB,1.2.3.4,0.0.0.0,0.0.0.0,0.0.0.0,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeee,ABCDEFG,5.1.4,Windows,\"Microsoft Windows 10 Pro , 64-bit\",1,,,\"\",success,,0,user-logon,0,gw1,1234567,0x8000000000000000",
    "event": {
      "category": [
        "session"
      ],
      "dataset": "globalprotect",
      "outcome": "success",
      "type": [
        "start"
      ]
    },
    "@timestamp": "2020-12-08T14:30:55Z",
    "action": {
      "name": "gw-auth",
      "outcome": "success",
      "type": "0"
    },
    "host": {
      "id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeee",
      "name": "AAAABBBBB",
      "os": {
        "version": "Microsoft Windows 10 Pro , 64-bit"
      }
    },
    "log": {
      "logger": "globalprotect"
    },
    "observer": {
      "product": "PAN-OS",
      "serial_number": "ABCDEFG"
    },
    "paloalto": {
      "EventID": "gw-auth",
      "Threat_ContentType": "0",
      "VirtualLocation": "vsys1",
      "connection": {
        "stage": "login"
      }
    },
    "related": {
      "ip": [
        "1.2.3.4"
      ],
      "user": [
        "user"
      ]
    },
    "source": {
      "address": "1.2.3.4",
      "geo": {
        "country_iso_code": "FR"
      },
      "ip": "1.2.3.4",
      "user": {
        "name": "user"
      }
    },
    "user": {
      "name": "user"
    },
    "user_agent": {
      "os": {
        "name": "Windows",
        "version": "Microsoft Windows 10 Pro , 64-bit"
      }
    }
  }
}