I followed this article to send my sophos utm logs to elk
when i start logstash service logs are recieved from sophos fw but get error on all recieved logs as bellow
[ERROR][logstash.codecs.json ][input][919266bd10e76503d980d2b94f51c5195b09c1afe56017a2ecf62d9c60086291] JSON parse error, original data now in message field {:message=>"Could not set field 'ip' on object 'my sophos ip' to value '127.0.0.1'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string", :exception=>Java::OrgLogstash::Accessors::InvalidFieldSetException, :data=>"{"@timestamp":"2022-08-26T10:38:05.455937+04:30","@Version":"1","message":"08:26-10:38:05 my-fw-name ulogd[32435]: id="2002" sever>.............
Edit : This is the log sample that i am trying to filter :
Sep 7 10:27:49 10.211.254.6 2022: 09:07-10:27:48 sepahbod-main-fw ulogd[7421]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62446" initf="eth6" srcmac="b4:14:89:71:bc:90" dstmac="00:1a:8c:36:6f:84" srcip="10.139.0.14" dstip="192.168.7.5" proto="17" length="58" tos="0x00" prec="0x00" ttl="126" srcport="59212" dstport="53"
and this is grok filter that i am using
can anyone help me to solve this issue? sorry for my bad english than