In the Palo Alto Network Pack, what purpose does the index index || ‘firewall’?
It sets the index to the value of the field index, if it exists, else set it to firewall. It’s a defense against the condition where the data comes in raw from the syslog input and has no metadata assigned.