Log Forwarding Profile error message 1054 logtype filters
9916
Created On 02/02/23 12:21 PM - Last Modified 03/01/24 07:54 AM
Symptom
An error message similar to the one shown in the screenshot below appears when trying to add a new profile or editing an existing filter.
You might even not get the error message but see that the popup window to select the logs for the query you need to configure gets stuck, preventing you to save the filter.
Environment
Cortex Data Lake
Cause
As per service design, there's a size limit established on backend side for a log forwarding profile.
If you need to use many filters for log forwarding you need to split the filters into several profiles with a maximum of 5 filters per profile.
Resolution
- If you can't edit an existing profile and getting the error described before, you need to delete the existing profile and recreate it using only 5 filters and adding the remaining filters to one or more additional profiles with 5 filters each.
- If you're trying to create a new profile and getting the referenced error, make sure you're not setting more than 5 logtype filters. If there are profiles which have 6 filters or more, split them into 2 or more log forwarding profiles.
- If you're still getting the error message, please open a support case and provide all the relevant information to facilitate the investigation.
- CDL instance ID
- CDL serial number
- CSP account ID and TSG ID (if available)
- How many profiles you have configured?
- Is there any profile with more than 5 filters?
Additional Information
Reference document to Create Log Filters
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/create-log-filters#id45d692f3-6f90-4a7c-bd2d-a8dc385fbf76