Field default_device_message not being helpful

[sanchez]

While working with a siem, the use of logs exporter has been a good upgrade from opsec lea. But as you can see in the screenshot; all the important messages are being reported in the default_device_message section. Hence to normalize and take important bits of information; like HTTP login; user= admin ; it is required to extract these fields. Hence for a wide range of syslog messages; a number of signatures need to be added. 
Is there any provision of important fields within default_device_message being extracted within log as  in case of source address :: src=...........?

Help would be much appreciated.

[PhoneBoy]

That doesn't look like a message from Log Exporter but from the Gaia OS.

[sanchez]

I do have other logs too ... but they are of the similar structure with most of the message within the default_message field. What would be the issue with the exporter? How can this issue be solved?

[PhoneBoy · Accepted solution]

Gaia (the underlying OS based on Linux) generates its own logs independent of Access Control and Threat Prevention.
Normally, these logs are kept entirely separate, but can be sent to the same logs that get exported via Log Exporter.
This does not happen by default. 
You can set/change that here from the WebUI on the relevant device(s):

Most of the OS logs have completely different context from the things we log with Access Control and Threat Prevention.
As such, all the information from the OS logs is generally put into a single log field.
You can verify this by reviewing the actual log entries in SmartConsole/SmartView. 
When those logs are exported via Log Exporter, they likewise end up in a single log field.

In other words, this is working as expected.
If you export syslog directly from the devices themselves to the SIEM, it's possible the information might be parsed differently.

[sanchez]

thanks !!! you cleared the doubt...