How can I enable the agent to ingest 200 squid logs

[danieleperera]

Hi,

I'm trying to force the agent to read squid 200 logs and ingest them, however, I'm facing some issue when I tried to overwrite the rule.
Below are the steps i've performed to achieve the goal.

1. Read /var/log/squid/access.log and find a 200 request:
   1713250390.796 199 172.x.x.x TCP_TUNNEL/200 4154 CONNECT ifconfig.me:443 - HIER_DIRECT/34.x.x.x-
2. Use Wazuh dashboard -> tools -> Ruleset Test to find which rule is triggered. The test identified that the rule id is triggered 35000

**Messages:
	WARNING: (7003): '42781f90' token expires
	INFO: (7202): Session initialized with token '5f02df89'

**Phase 1: Completed pre-decoding.
	full event: '1713250390.796    199 172.x.x.x TCP_TUNNEL/200 4154 CONNECT ifconfig.me:443 - HIER_DIRECT/34.x.x.x -'
	timestamp: '1713250390.796   '

**Phase 2: Completed decoding.
	name: 'squid-accesslog'
	action: 'TCP_TUNNEL'
	id: '200'
	srcip: '172.x.x.x'
	url: 'ifconfig.me:443'

**Phase 3: Completed filtering (rules).
	id: '35000'
	level: '0'
	description: 'Squid messages grouped.'
	groups: '["squid"]'
	firedtimes: '1'
	mail: 'false'

3. Wazuh -> Management -> Rules -> Custom rules -> appended the following:

<group name="squid,">
  <rule id="35000" level="5" overwrite="yes">
    <if_sid>35000</if_sid>
    <id_pcre2>^200</id_pcre2>
    <description>Squid works </description>
  </rule>
</group>

4. Once added, i've tried to run a test on the raw 200 log using the Ruleset Test feature in custom rules. The test is not successful as i do not get **Alert to be generated. entry.

What am i missing here?
Any support is highly appreciated.

Thanks

[danieleperera]

I needed to save and restart wazuh dashboard. This solved the issue.