Logging Service
With Logging Service, currently called Cortex Data Lake, logs are no longer sent to Panorama or a collector group, but instead go up into the cloud through a secure connection. This is a licensed feature, so every firewall that should log to the cloud will need to be outfitted with a license. Once the licensing is in order and Data Lake is properly set up at https://apps.paloaltonetworks.com/marketplace/cortex_data_lake, you can configure each firewall locally or through a Panorama template.
From Device | Setup | Management | Logging Service, you can select Enable Logging Service. As the following screenshot shows, you can also use Enable Duplicate Logging, which writes logs to Panorama or the log collectors and sends a copy to Cortex Data Lake. PA-5200 and PA-7000 can have multiple (up to 20) simultaneous connections to Cortex Data Lake. Enable Enhanced Application Logging will increase information gathered about applications and sends this to Cortex Data Lake....
