firepower log collect

[ssrinidhi]

I there option to collect firepower logs in a readable format(json/xml) rather than using estreamer. Or can we do it using proxy

[Marius Gunnerud]

Estreamer is the way to go here, and have a client that fetches the logs from the estreamer server and parse it into JSON.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215631-understand-estreamer-and-troubleshoot-en.html

[ssrinidhi]

thank you @Marius Gunnerud , also what is the format does the estreamer return the logs, is there a role that proxy server could play to get the data in readable format

[Marius Gunnerud]

I have not dived that deep into estreamer, but according to the documentation it uses UTF-8

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/api/eStreamer/EventStreamerIntegrationGuide_660.pdf