Hi, after working with the MS support team and their dev's, they determined that Meraki logs don't follow the RFC standard for syslog message. Basically, what is happening is at the first = in the syslog message, Sentinel dropping everything before it and the remainder of the message get captured.

The workaround for this was to have rsyslog write the Meraki logs to a file then we have Sentinel ingest the files into a custom log table. You will want to have log rotation setup to ensure that it does not grow infinitely. Here are the config notes I have. To have Sentinel pull the custom log, that is configured in Log Analytics under Advanced settings.

Let me know if you have any questions.

Configure Log Rotate

Create directory:

sudo mkdir /var/log/meraki

Assign permission on folder:

sudo chown syslog /var/log/meraki

Create log rotation configuration file:

vi /etc/logrotate.d/meraki

/var/log/meraki/meraki {

    rotate 3

    missingok

    create 0640 syslog adm

    notifempty

    compress

    size 100M

    delaycompress

    sharedscripts

    postrotate

            /usr/lib/rsyslog/rsyslog-rotate

    endscript

}

Configure rsyslog to send meraki logs to file:

vi /etc/rsyslog.conf

Add the following line at the bottom

if ($fromhost-ip=='172.16.15.254') then /var/log/meraki/meraki