Configure a Log Decoder to Accept Protobuf

There are occasions when you want to analyze log files that are in protobuf (Protocol Buffer) format. You can configure a Log Decoder with a Log Collector service to accept logs in protobuf (Protocol Buffer) format.

To import a log file to a Log Decoder:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.
  2. Select a Log Decoder with a Log Collector service in the Service list, and select netwitness_actiondd_33x16.png​ > View > Explore.
    The Explore view for the Log Decoder -Log Collector is displayed.
    netwitness_12.1_explvwldlc_1122.png
  3. Navigate to event-processors/logdecoder/destinations/logdecoder/consumer/processors/tcpconnector/config
    ​Your screen should look similar to the following.
    netwitness_12.1_ldlcexpvw_1122.png
  4. For the send-protobuf field, select false, and change the value to true.
  5. Navigate to event-processors/logdecoder/destinations/logdecoder/consumer/processors/tcpconnector/
    config/connector/channel/tcp     and change the port value to 50202.
  6. Navigate to event-processors/logdecoder/destinations/logdecoder/consumer/processors/tcpconnector/
    config/connector/event     and change the following parameters:
    • Clear the delimiter field
    • Change format to %text%