For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Livius's avatar
Livius
Icon for Cirrus rankCirrus
Mar 05, 2018

F5 HSL output not in JSON format for POST messages

Hi all,

 

I have a HTTP analytics profile attached to a VS which logs the HTTP requests to a pool of logstash servers. The input in logstash is as follows :

 

lastLockChangeTime": 0,"lastLockTimeMsec": 0},{"ts": 1520252612040,"type": "TunerReport","index": 5,"signalLevel": 5.700000,"SNR": 41.420000,"preECBER": 0.000000,"postECBER": 0.000000,"elapsedTime": 0,"unerroreds": 873628337,"erroreds": 0,"correcteds": 23,"frequency": 538000000,"locked": true,"lastLockChangeTime": 0,"lastLockTimeMsec": 0},{"ts": 1520252612060,"type": "TunerReport","index": 6,"signalLevel": 0.000000,"SNR": 0.000000,"preECBER": 0.000000,"postECBER": 0.000000,"elapsedTime": 0,"unerroreds": 0,"erroreds": 0,"correcteds": 0,"frequency": 0,"locked": false,"lastLockChangeTime": 0,"lastLockTimeM

 

Host: httsp.test.ustest.com POST /report HTTP/1.1 X-dev: 3C36E4-EOxxxx-xxxxx X-Forwarded-For: 1.1.1.1 content-type: application/json Content-Length: 2788

 

According to the developers the lines are not properly terminated and not in json format. As for the log publisher I am using splunk format as output. Anything I can tune?

 

3 Replies

  • Hi guys,

     

    since nobody answered that in 1 day timeframe, let me try to rephrase :

     

    How can I make sure the logging data from F5 is in JSON format?

     

  • Hi Guys,

     

    Getting back to this: does analytics log ALL HTTP requests? Any idea what these counters mean ?

     

    Entity="Traffic",AggrInterval="10",EOCTimestamp="1521043020",RequestStartTimestamp="1521043020",ResponseStartTimestamp="1521043020",

     

    Thanks!