Unable to see threat logs in the Monitor tab

• Panorama queries the Log Collectors in order to see the logs
• The threat logs window comes up empty with no logs
• The FWs are sending all log type to Log Collectors
• Upon checking the query jobs we can see that Panorama launches the query
  
  

  admin@panorama(primary-active)> show query jobs  ID        Enqueue Time         State       Database  nlogs     Runtime(ms)    User            Filter ------------------------------------------------------------------------------------------------------------------------------------------------------------- 764       2026/02/06 13:20:05  COMPLETE    threat    220       351.40         admin           ((((receive_time leq 'now')) and ((((((((((((subtype eq 'attack')) or ((subtype eq 'virus'))) or ((subtype eq 'spyware'))) or ((subtype eq 'vulnerability'))) or ((subtype eq 'flood'))) or ((subtype eq 'packet'))) or ((subtype eq 'resource'))) or ((subtype eq 'scan'))) or ((subtype eq 'wildfire-virus'))) or ((subtype eq 'ml-virus'))) or ((subtype eq 'ai-security')))) and ((((((dg_hier_level_1 eq '1396')) or ((dg_hier_level_2 eq '1396'))) or ((dg_hier_level_3 eq '1396'))) or ((dg_hier_level_4 eq '1396'))) and ((receive_time in 'last-hour'))))

• However, Log Collectors do not show any threat log related query
• Reportd.log shows the following errors
  
  

  2026-02-06 13:20:03.341 +0100 Error:  pan_log_query_parse_single_expr(pan_log_query.c:13222): failed to parse term: subtype eq ai-security first round, try address expansion 2026-02-06 13:20:03.341 +0100 Error:  pan_config_parse(pan_log_query.y:116): unable to parse single expr: subtype eq ai-security  2026-02-06 13:20:03.342 +0100 Error:  pan_log_query_parse_nolock(pan_log_query.c:13540): Invalid value ai-security for field subtype  2026-02-06 13:20:03.342 +0100 Error:  pan_log_query_parse_nolock(pan_log_query.c:13541): query: ((((receive_time leq 'now')) and ((((((((((((subtype eq 'attack')) or ((subtype eq 'virus'))) or ((subtype eq 'spyware'))) or ((subtype eq 'vulnerability'))) or ((subtype eq 'flood'))) or ((subtype eq 'packet'))) or ((subtype eq 'resource'))) or ((subtype eq 'scan'))) or ((subtype eq 'wildfire-virus'))) or ((subtype eq 'ml-virus'))) or ((subtype eq 'ai-security')))) and ((((((dg_hier_level_1 eq '1396')) or ((dg_hier_level_2 eq '1396'))) or ((dg_hier_level_3 eq '1396'))) or ((dg_hier_level_4 eq '1396'))) and ((receive_time in 'last-hour')))) 2026-02-06 13:20:03.342 +0100 Error:  pan_es_get_query(pan_es_query.c:2084): Error parsing query 2026-02-06 13:20:03.342 +0100 Error:  pan_logmgr_handle_dlcq(pan_cfg_logmgr_task.c:14303): logmgr_qtask: Failed to 'next' a dlc query job

  
  
  

Panorama running 11.2.7-h8
Log Collectors running 11.1.3-h4

Panorama running 11.2.7-h8 which has the support of ai security, while their log collectors running 11.1.3-h4, do not have support of ai security. That causes parsing failures on log collectors.

1. Upgrade Log Collectors to 11.2.5 or higher