Citrix ADC 集成

{
    "@timestamp": "2022-10-07T06:24:46.588Z",
    "agent": {
        "ephemeral_id": "6bbf5dd0-e14b-4006-ac77-ee175a9e81b8",
        "id": "6713ae74-2a36-4e79-bc7b-954d6b48d5bd",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.4.1"
    },
    "citrix_adc": {
        "interface": {
            "disabled": {
                "count": 0
            },
            "link": {
                "down_time": "00:00:11",
                "up_time": "4.06:45:16"
            },
            "mac": {
                "moved": {
                    "count": 0,
                    "rate": 0
                }
            },
            "packets": {
                "inbound": {
                    "dropped": {
                        "count": 2797172,
                        "rate": 32
                    },
                    "dropped_by_hardware": {
                        "count": 0,
                        "rate": 0
                    },
                    "error_free": {
                        "discarded": {
                            "count": 0,
                            "rate": 0
                        }
                    }
                },
                "outbound": {
                    "dropped_by_hardware": {
                        "count": 0,
                        "rate": 0
                    },
                    "error_free": {
                        "discarded": {
                            "count": 0,
                            "rate": 0
                        }
                    }
                },
                "received": {
                    "count": 5396347,
                    "jumbo": {
                        "count": 0,
                        "rate": 0
                    },
                    "multicast": {
                        "count": 278537,
                        "rate": 0
                    },
                    "rate": 38,
                    "tagged": {
                        "count": 0,
                        "rate": 0
                    }
                },
                "transmission": {
                    "dropped": {
                        "count": 0,
                        "rate": 0
                    }
                },
                "transmitted": {
                    "count": 2511171,
                    "jumbo": {
                        "count": 0,
                        "rate": 0
                    },
                    "rate": 5,
                    "tagged": {
                        "count": 0,
                        "rate": 0
                    }
                }
            },
            "received": {
                "bytes": {
                    "rate": 4603,
                    "value": 1103884030
                }
            },
            "stalled": {
                "count": 0
            },
            "state": "UP",
            "transmitted": {
                "bytes": {
                    "rate": 1924,
                    "value": 776571650
                }
            }
        }
    },
    "data_stream": {
        "dataset": "citrix_adc.interface",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "6713ae74-2a36-4e79-bc7b-954d6b48d5bd",
        "snapshot": false,
        "version": "8.4.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "created": "2022-10-07T06:24:46.588Z",
        "dataset": "citrix_adc.interface",
        "ingested": "2022-10-07T06:24:50Z",
        "kind": "event",
        "module": "citrix_adc",
        "original": "{\"curintfstate\":\"UP\",\"curlinkdowntime\":\"00:00:11\",\"curlinkstate\":\"DOWN\",\"curlinkuptime\":\"4.06:45:16\",\"errdroppedrxpkts\":\"2797172\",\"errdroppedrxpktsrate\":32,\"errdroppedtxpkts\":\"0\",\"errdroppedtxpktsrate\":0,\"errifindiscards\":\"0\",\"errifindiscardsrate\":0,\"errlinkhangs\":\"0\",\"errnicmuted\":\"0\",\"errpktrx\":\"0\",\"errpktrxrate\":0,\"errpkttx\":\"0\",\"errpkttxrate\":0,\"id\":\"0/1\",\"interfacealias\":\"\",\"jumbopktsreceived\":\"0\",\"jumbopktsreceivedrate\":0,\"jumbopktstransmitted\":\"0\",\"jumbopktstransmittedrate\":0,\"linkreinits\":\"0\",\"macmovedrate\":0,\"netscalerpktsrate\":6,\"nicerrdisables\":\"0\",\"nicerrifoutdiscards\":\"0\",\"nicerrifoutdiscardsrate\":0,\"nicmulticastpktsrate\":0,\"nicrxstalls\":\"0\",\"nicstsstalls\":\"0\",\"nictotmulticastpkts\":\"278537\",\"nictxstalls\":\"0\",\"rxbytesrate\":4603,\"rxcrcerrors\":\"0\",\"rxcrcerrorsrate\":0,\"rxlacpdu\":\"0\",\"rxlacpdurate\":0,\"rxpktsrate\":38,\"totmacmoved\":\"0\",\"totnetscalerpkts\":\"2493179\",\"totrxbytes\":\"1103884064\",\"totrxpkts\":\"5396347\",\"tottxbytes\":\"776571619\",\"tottxpkts\":\"2511171\",\"trunkpktsreceived\":\"0\",\"trunkpktsreceivedrate\":0,\"trunkpktstransmitted\":\"0\",\"trunkpktstransmittedrate\":0,\"txbytesrate\":1924,\"txlacpdu\":\"0\",\"txlacpdurate\":0,\"txpktsrate\":5}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "interface": {
        "id": "0/1"
    },
    "tags": [
        "preserve_original_event",
        "citrix_adc-interface",
        "forwarded"
    ]
}

{
    "@timestamp": "2022-10-07T06:25:28.550Z",
    "agent": {
        "ephemeral_id": "5d00842d-a4ee-4502-9a8c-16100e326dc0",
        "id": "6713ae74-2a36-4e79-bc7b-954d6b48d5bd",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.4.1"
    },
    "citrix_adc": {
        "lbvserver": {
            "client": {
                "connections": {
                    "current": {
                        "count": 8
                    },
                    "established": {
                        "count": 6
                    }
                },
                "response_time": {
                    "application_performance_index": 1
                }
            },
            "connections": {
                "actual": {
                    "count": 8
                }
            },
            "down": {
                "backup": {
                    "hits": 13
                }
            },
            "health": 67,
            "hit": {
                "count": 10,
                "rate": 5
            },
            "name": "elastic",
            "packets": {
                "received": {
                    "count": 7
                },
                "sent": {
                    "count": 8,
                    "rate": 8
                }
            },
            "protocol": "HTTP",
            "request": {
                "deferred": {
                    "count": 13,
                    "rate": 13
                },
                "received": {
                    "bytes": {
                        "rate": 7,
                        "value": 7
                    },
                    "count": 5,
                    "rate": 5
                },
                "surge_queue": {
                    "count": 8
                },
                "waiting": {
                    "count": 6
                }
            },
            "requests_responses": {
                "dropped": {
                    "count": 13
                },
                "invalid": {
                    "count": 13
                }
            },
            "response": {
                "received": {
                    "bytes": {
                        "rate": 7,
                        "value": 7
                    },
                    "count": 5,
                    "rate": 5
                }
            },
            "service": {
                "active": {
                    "count": 10
                },
                "inactive": {
                    "count": 6
                }
            },
            "spillover": {
                "count": 8
            },
            "state": "DOWN",
            "threshold": {
                "spillover": 8
            },
            "time_to_last_byte": {
                "avg": 6
            },
            "transaction": {
                "frustrating": {
                    "count": 1
                },
                "tolerable": {
                    "count": 3
                }
            }
        }
    },
    "data_stream": {
        "dataset": "citrix_adc.lbvserver",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "6713ae74-2a36-4e79-bc7b-954d6b48d5bd",
        "snapshot": false,
        "version": "8.4.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "created": "2022-10-07T06:25:28.550Z",
        "dataset": "citrix_adc.lbvserver",
        "ingested": "2022-10-07T06:25:32Z",
        "kind": "event",
        "module": "citrix_adc",
        "original": "{\"actsvcs\":\"10\",\"avgcltttlb\":\"6\",\"cltresponsetimeapdex\":1,\"cltttlbtransactionsrate\":3,\"cpuusagepm\":\"10\",\"curbackuppersistencesessions\":\"8\",\"curclntconnections\":\"8\",\"curmptcpsessions\":\"13\",\"curpersistencesessions\":\"8\",\"cursrvrconnections\":\"8\",\"cursubflowconn\":\"13\",\"deferredreq\":\"13\",\"deferredreqrate\":13,\"establishedconn\":\"6\",\"frustratingttlbtransactions\":\"1\",\"frustratingttlbtransactionsrate\":1,\"h2requestsrate\":7,\"h2responsesrate\":7,\"hitsrate\":5,\"httpmaxhdrfldlenpkts\":\"3\",\"httpmaxhdrszpkts\":\"3\",\"inactsvcs\":\"6\",\"invalidrequestresponse\":\"13\",\"invalidrequestresponsedropped\":\"13\",\"labelledconn\":\"8\",\"name\":\"elastic\",\"pktsrecvdrate\":8,\"pktssentrate\":8,\"primaryipaddress\":\"8.8.8.8\",\"primaryport\":80,\"pushlabel\":\"8\",\"reqretrycount\":\"3\",\"reqretrycountexceeded\":\"3\",\"requestbytesrate\":7,\"requestsrate\":5,\"responsebytesrate\":7,\"responsesrate\":5,\"sothreshold\":\"8\",\"state\":\"DOWN\",\"surgecount\":\"8\",\"svcsurgecount\":\"8\",\"svrbusyerrrate\":3,\"tcpmaxooopkts\":\"3\",\"toleratingttlbtransactions\":\"3\",\"toleratingttlbtransactionsrate\":1,\"totalconnreassemblyqueue75\":\"13\",\"totalconnreassemblyqueueflush\":\"3\",\"totalh2requests\":\"7\",\"totalh2responses\":\"7\",\"totalpktsrecvd\":\"7\",\"totalpktssent\":\"8\",\"totalrequestbytes\":\"7\",\"totalrequests\":\"5\",\"totalresponsebytes\":\"7\",\"totalresponses\":\"5\",\"totalsvrbusyerr\":\"3\",\"totcltttlbtransactions\":\"3\",\"tothits\":\"10\",\"totspillovers\":\"8\",\"totvserverdownbackuphits\":\"13\",\"type\":\"HTTP\",\"vslbhealth\":\"67\",\"vsvrsurgecount\":\"6\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "related": {
        "ip": [
            "8.8.8.8"
        ]
    },
    "server": {
        "ip": "8.8.8.8",
        "port": 80
    },
    "tags": [
        "preserve_original_event",
        "citrix_adc-lbvserver",
        "forwarded"
    ]
}

{
    "@timestamp": "2022-10-07T06:26:11.339Z",
    "agent": {
        "ephemeral_id": "2fa2a685-d35a-40a6-8212-7a9dd581d647",
        "id": "6713ae74-2a36-4e79-bc7b-954d6b48d5bd",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.4.1"
    },
    "citrix_adc": {
        "service": {
            "client_connection": {
                "count": 8
            },
            "primary": {
                "ip_address": "127.0.0.1",
                "port": 80
            },
            "request": {
                "bytes": {
                    "rate": 139,
                    "value": 8334520
                },
                "count": 15133,
                "rate": 0
            },
            "response": {
                "bytes": {
                    "rate": 316,
                    "value": 26482988
                },
                "count": 15133,
                "rate": 0
            },
            "reuse_pool": 2,
            "server": {
                "connection": {
                    "count": 2,
                    "established": {
                        "count": 2
                    }
                },
                "time_to_first_byte": {
                    "avg": 34
                }
            },
            "surge_queue": {
                "count": 0
            },
            "throughput": {
                "rate": 0,
                "value": 0
            },
            "transaction": {
                "active": {
                    "count": 0
                },
                "frustrating": {
                    "count": 0
                },
                "time_to_last_byte": {
                    "count": 0
                },
                "tolerable": {
                    "count": 0
                }
            }
        }
    },
    "data_stream": {
        "dataset": "citrix_adc.service",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "6713ae74-2a36-4e79-bc7b-954d6b48d5bd",
        "snapshot": false,
        "version": "8.4.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "created": "2022-10-07T06:26:11.339Z",
        "dataset": "citrix_adc.service",
        "ingested": "2022-10-07T06:26:14Z",
        "kind": "event",
        "module": "citrix_adc",
        "original": "{\"activetransactions\":\"0\",\"avgsvrttfb\":\"34\",\"curclntconnections\":\"8\",\"curload\":\"0\",\"curreusepool\":\"2\",\"cursrvrconnections\":\"2\",\"curtflags\":\"0\",\"frustratingttlbtransactions\":\"0\",\"httpmaxhdrfldlenpkts\":\"0\",\"httpmaxhdrszpkts\":\"0\",\"maxclients\":\"0\",\"name\":\"nshttpd-gui-127.0.0.1-80\",\"primaryipaddress\":\"127.0.0.1\",\"primaryport\":80,\"requestbytesrate\":139,\"requestsrate\":0,\"responsebytesrate\":316,\"responsesrate\":0,\"serviceorder\":\"0\",\"servicetype\":\"HTTP\",\"state\":\"UP\",\"surgecount\":\"0\",\"svrestablishedconn\":\"2\",\"tcpmaxooopkts\":\"0\",\"throughput\":\"0\",\"throughputrate\":0,\"toleratingttlbtransactions\":\"0\",\"totalconnreassemblyqueue75\":\"0\",\"totalconnreassemblyqueueflush\":\"0\",\"totalrequestbytes\":\"8334520\",\"totalrequests\":\"15133\",\"totalresponsebytes\":\"26482988\",\"totalresponses\":\"15133\",\"totsvrttlbtransactions\":\"0\",\"vsvrservicehits\":\"0\",\"vsvrservicehitsrate\":0}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "related": {
        "ip": [
            "127.0.0.1"
        ]
    },
    "service": {
        "name": "nshttpd-gui-127.0.0.1-80",
        "state": "UP",
        "type": "HTTP"
    },
    "tags": [
        "preserve_original_event",
        "citrix_adc-service",
        "forwarded"
    ]
}

{
    "@timestamp": "2022-11-03T11:58:48.678Z",
    "agent": {
        "ephemeral_id": "17888c67-ea5e-4c24-ad2d-6e1572930f9d",
        "id": "f1fb7954-85ee-4fe3-971d-546763d1571b",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.4.1"
    },
    "citrix_adc": {
        "system": {
            "cpu": {
                "count": 1,
                "utilization": {
                    "additional_management": {
                        "pct": 0
                    },
                    "avg": {
                        "pct": 4294967300
                    },
                    "management": {
                        "pct": 0.8
                    },
                    "master": {
                        "pct": 4294967300
                    },
                    "packets": {
                        "pct": 1.1
                    },
                    "pct": 1.1,
                    "slave": {
                        "pct": 4294967300
                    }
                }
            },
            "disk": {
                "usage": {
                    "flash_partition": {
                        "pct": 12
                    },
                    "var_partition": {
                        "pct": 12
                    }
                }
            },
            "memory": {
                "size": {
                    "value": 0
                },
                "usage": {
                    "value": 226492416
                },
                "utilization": {
                    "pct": 21.114572
                }
            },
            "start": {
                "time": "2022-09-22T03:50:13.000Z"
            }
        }
    },
    "data_stream": {
        "dataset": "citrix_adc.system",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "f1fb7954-85ee-4fe3-971d-546763d1571b",
        "snapshot": false,
        "version": "8.4.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "created": "2022-11-03T11:58:48.678Z",
        "dataset": "citrix_adc.system",
        "ingested": "2022-11-03T11:58:52Z",
        "kind": "event",
        "module": "citrix_adc",
        "original": "{\"errorcode\":0,\"message\":\"Done\",\"severity\":\"NONE\",\"system\":{\"addimgmtcpuusagepcnt\":0,\"auxtemp0\":0,\"auxtemp1\":0,\"auxtemp2\":0,\"auxtemp3\":0,\"auxvolt0\":0,\"auxvolt1\":0,\"auxvolt2\":0,\"auxvolt3\":0,\"auxvolt4\":0,\"auxvolt5\":0,\"auxvolt6\":0,\"auxvolt7\":0,\"cpu0temp\":0,\"cpu1temp\":0,\"cpufan0speed\":0,\"cpufan1speed\":0,\"cpuusage\":\"1\",\"cpuusagepcnt\":1.1,\"disk0avail\":1278,\"disk0perusage\":12,\"disk0size\":1585,\"disk0used\":180,\"disk1avail\":11441,\"disk1perusage\":12,\"disk1size\":14179,\"disk1used\":1603,\"fan0speed\":0,\"fan2speed\":0,\"fan3speed\":0,\"fan4speed\":0,\"fan5speed\":0,\"fanspeed\":0,\"internaltemp\":0,\"mastercpuusage\":\"4294967295\",\"memsizemb\":\"0\",\"memusagepcnt\":21.114572,\"memuseinmb\":\"216\",\"mgmtcpu0usagepcnt\":0.8,\"mgmtcpuusagepcnt\":0.8,\"numcpus\":\"1\",\"pktcpuusagepcnt\":1.1,\"powersupply1status\":\"NOT SUPPORTED\",\"powersupply2status\":\"NOT SUPPORTED\",\"powersupply3status\":\"NOT SUPPORTED\",\"powersupply4status\":\"NOT SUPPORTED\",\"rescpuusage\":\"4294967295\",\"rescpuusagepcnt\":4294967295,\"slavecpuusage\":\"4294967295\",\"starttime\":\"Thu Sep 22 03:50:13 2022\",\"starttimelocal\":\"Thu Sep 22 09:20:13 2022\",\"systemfanspeed\":0,\"timesincestart\":\"00:00:00\",\"voltagev12n\":0,\"voltagev12p\":0,\"voltagev33main\":0,\"voltagev33stby\":0,\"voltagev5n\":0,\"voltagev5p\":0,\"voltagev5sb\":0,\"voltagevbat\":0,\"voltagevcc0\":0,\"voltagevcc1\":0,\"voltagevsen2\":0,\"voltagevtt\":0}}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "tags": [
        "preserve_original_event",
        "citrix_adc-system",
        "forwarded"
    ]
}

{
    "@timestamp": "2022-10-10T11:42:13.787Z",
    "agent": {
        "ephemeral_id": "8fd05f47-0933-4b28-8412-6d4b6f365dff",
        "id": "98ae8a23-ea52-4679-b111-33a6d6e8db77",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.4.1"
    },
    "citrix_adc": {
        "vpn": {
            "client_server": {
                "request": {
                    "hit": {
                        "count": 16,
                        "rate": 16
                    }
                }
            },
            "configuration_request_served": {
                "count": 8,
                "rate": 8
            },
            "cps": {
                "failure": {
                    "count": 11,
                    "rate": 11
                },
                "success": {
                    "count": 4,
                    "rate": 11
                }
            },
            "file_system": {
                "request": {
                    "received": {
                        "count": 16,
                        "rate": 16
                    }
                }
            },
            "ica": {
                "license_failure": {
                    "count": 7,
                    "rate": 7
                }
            },
            "login_failed": {
                "license_unavailable": {
                    "count": 16
                }
            },
            "login_page": {
                "hits": 8
            },
            "socks": {
                "client_error": {
                    "count": 8,
                    "rate": 8
                },
                "connection": {
                    "request": {
                        "received": {
                            "count": 3,
                            "rate": 2
                        },
                        "sent": {
                            "count": 2,
                            "rate": 2
                        }
                    },
                    "response": {
                        "received": {
                            "count": 2,
                            "rate": 2
                        },
                        "sent": {
                            "count": 8,
                            "rate": 8
                        }
                    }
                },
                "method": {
                    "request": {
                        "received": {
                            "count": 17,
                            "rate": 17
                        },
                        "sent": {
                            "count": 17,
                            "rate": 17
                        }
                    },
                    "response": {
                        "received": {
                            "count": 3,
                            "rate": 3
                        },
                        "sent": {
                            "count": 3,
                            "rate": 3
                        }
                    }
                },
                "server_error": {
                    "count": 8,
                    "rate": 8
                }
            },
            "sta": {
                "connection": {
                    "failure": {
                        "count": 4,
                        "rate": 4
                    },
                    "success": {
                        "count": 4,
                        "rate": 4
                    }
                },
                "request": {
                    "sent": {
                        "count": 11,
                        "rate": 11
                    }
                },
                "response": {
                    "received": {
                        "count": 7,
                        "rate": 7
                    }
                }
            }
        }
    },
    "data_stream": {
        "dataset": "citrix_adc.vpn",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "98ae8a23-ea52-4679-b111-33a6d6e8db77",
        "snapshot": false,
        "version": "8.4.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "created": "2022-10-10T11:42:13.787Z",
        "dataset": "citrix_adc.vpn",
        "ingested": "2022-10-10T11:42:17Z",
        "kind": "event",
        "module": "citrix_adc",
        "original": "{\"errorcode\":0,\"message\":\"Done\",\"severity\":\"NONE\",\"vpn\":{\"cfghtmlserved\":\"8\",\"cfghtmlservedrate\":8,\"cpsconnfailure\":\"11\",\"cpsconnfailurerate\":11,\"cpsconnsuccess\":\"4\",\"cpsconnsuccessrate\":11,\"csconnsuccrate\":16,\"csgconnectedusersrate\":17,\"csgptktvalidatenotstarted\":\"5\",\"csgptktvalidatenotstartedrate\":5,\"csgrtktvalidatenotstarted\":\"9\",\"csgrtktvalidatenotstartedrate\":9,\"csgtotalconnectedusers\":\"9\",\"cshttpprobehit\":\"16\",\"cshttpprobehitrate\":16,\"csnonhttpprobehit\":\"16\",\"csnonhttpprobehitrate\":16,\"csrequesthit\":\"16\",\"csrequesthitrate\":16,\"dnsreqhit\":\"8\",\"dnsreqhitrate\":8,\"fsrequestrate\":16,\"icalicensefailure\":\"7\",\"icalicensefailurerate\":7,\"iipdisabledmipdisabled\":\"9\",\"iipdisabledmipdisabledrate\":9,\"iipdisabledmipused\":\"16\",\"iipdisabledmipusedrate\":12,\"iipfailedmipdisabled\":\"9\",\"iipfailedmipdisabledrate\":9,\"iipfailedmipused\":\"12\",\"iipfailedmipusedrate\":12,\"iipspillovermipused\":\"12\",\"iipspillovermipusedrate\":12,\"indexhtmlhit\":\"8\",\"indexhtmlnoserved\":\"8\",\"socksclienterror\":\"8\",\"socksclienterrorrate\":8,\"socksconnreqrcvd\":\"3\",\"socksconnreqrcvdrate\":2,\"socksconnreqsent\":\"2\",\"socksconnreqsentrate\":2,\"socksconnresprcvd\":\"2\",\"socksconnresprcvdrate\":2,\"socksconnrespsent\":\"8\",\"socksconnrespsentrate\":8,\"socksmethreqrcvd\":\"17\",\"socksmethreqrcvdrate\":17,\"socksmethreqsent\":\"17\",\"socksmethreqsentrate\":17,\"socksmethresprcvd\":\"3\",\"socksmethresprcvdrate\":3,\"socksmethrespsent\":\"3\",\"socksmethrespsentrate\":3,\"socksservererror\":\"8\",\"socksservererrorrate\":8,\"staconnfailure\":\"4\",\"staconnfailurerate\":4,\"staconnsuccess\":\"4\",\"staconnsuccessrate\":4,\"stamonfail\":\"5\",\"stamonfailrate\":5,\"stamonrcvd\":\"7\",\"stamonrcvdrate\":5,\"stamonsent\":\"7\",\"stamonsentrate\":7,\"stamonsucc\":\"5\",\"stamonsuccrate\":5,\"starequestsent\":\"11\",\"starequestsentrate\":11,\"staresponserecvd\":\"7\",\"staresponserecvdrate\":7,\"totalcsconnsucc\":\"16\",\"totalfsrequest\":\"16\",\"vpnlicensefail\":\"16\",\"winsrequesthit\":\"16\",\"winsrequesthitrate\":16}}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "tags": [
        "preserve_original_event",
        "citrix_adc-vpn",
        "forwarded"
    ]
}

{
    "@timestamp": "2012-12-18T21:46:17.000Z",
    "agent": {
        "ephemeral_id": "2976e761-4399-4de7-8ea0-97ea83ec7726",
        "id": "418f7c57-c332-4913-b3ec-ddaa31f832a0",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.12.0"
    },
    "citrix": {
        "cef_format": true,
        "cef_version": "0",
        "detail": "CEF:0|Citrix|NetScaler|NS10.0|APPFW|APPFW_STARTURL|6|src=175.16.199.1 spt=54711 method=GET request=http://vpx247.example.net/FFC/login_post.html?abc\\=def msg=Disallow Illegal URL. cn1=465 cn2=535 cs1=profile1 cs2=PPE0 cs3=IliG4Dxp1SjOhKVRDVBXmqvAaIcA000 cs4=ALERT cs5=2012 act=not blocked",
        "device_event_class_id": "APPFW",
        "device_product": "NetScaler",
        "device_vendor": "Citrix",
        "device_version": "NS10.0",
        "facility": "local0",
        "name": "APPFW_STARTURL",
        "ppe_id": "PPE0",
        "priority": "info",
        "profile_name": "profile1",
        "session_id": "IliG4Dxp1SjOhKVRDVBXmqvAaIcA000",
        "severity": "ALERT"
    },
    "client": {
        "geo": {
            "city_name": "London",
            "continent_name": "Europe",
            "country_iso_code": "GB",
            "country_name": "United Kingdom",
            "location": {
                "lat": 51.5142,
                "lon": -0.0931
            },
            "region_iso_code": "GB-ENG",
            "region_name": "England"
        },
        "ip": "81.2.69.144"
    },
    "data_stream": {
        "dataset": "citrix_adc.log",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "418f7c57-c332-4913-b3ec-ddaa31f832a0",
        "snapshot": false,
        "version": "8.12.0"
    },
    "event": {
        "action": "not blocked",
        "agent_id_status": "verified",
        "dataset": "citrix_adc.log",
        "id": "465",
        "ingested": "2024-03-20T08:51:14Z",
        "original": "Dec 18 21:46:17 <local0.info> 81.2.69.144 CEF:0|Citrix|NetScaler|NS10.0|APPFW|APPFW_STARTURL|6|src=175.16.199.1 spt=54711 method=GET request=http://vpx247.example.net/FFC/login_post.html?abc\\=def msg=Disallow Illegal URL. cn1=465 cn2=535 cs1=profile1 cs2=PPE0 cs3=IliG4Dxp1SjOhKVRDVBXmqvAaIcA000 cs4=ALERT cs5=2012 act=not blocked",
        "severity": 6,
        "timezone": "+00:00"
    },
    "http": {
        "request": {
            "id": "535",
            "method": "GET"
        }
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "source": {
            "address": "192.168.249.4:48549"
        }
    },
    "message": "Disallow Illegal URL.",
    "observer": {
        "product": "Netscaler",
        "type": "firewall",
        "vendor": "Citrix"
    },
    "source": {
        "geo": {
            "city_name": "Changchun",
            "continent_name": "Asia",
            "country_iso_code": "CN",
            "country_name": "China",
            "location": {
                "lat": 43.88,
                "lon": 125.3228
            },
            "region_iso_code": "CN-22",
            "region_name": "Jilin Sheng"
        },
        "ip": "175.16.199.1",
        "port": 54711
    },
    "tags": [
        "preserve_original_event",
        "citrix_adc.log",
        "forwarded"
    ],
    "url": {
        "domain": "vpx247.example.net",
        "extension": "html",
        "original": "http://vpx247.example.net/FFC/login_post.html?abc\\=def",
        "path": "/FFC/login_post.html",
        "query": "abc\\=def",
        "scheme": "http"
    }
}