elastic · andrewkroh · Aug 10, 2020 · May 22, 2020 · May 22, 2020 · Jul 14, 2020
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -63,6 +63,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Adds Gsuite Groups support. {pull}19725[19725]
 - Move file metrics to dataset endpoint {pull}19977[19977]
 - Add `while_pattern` type to multiline reader. {pull}19662[19662]
+- Tracking session end reason in panw module. {pull}18705[18705]
 - Fix PANW field spelling "veredict" to "verdict" on event.action {pull}18808[18808]
 
 *Heartbeat*

diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -105251,6 +105251,16 @@ type: long
 
 --
 
+*`panw.panos.endreason`*::
++
+--
+The reason a session terminated.
+
+
+type: keyword
+
+--
+
 [float]
 === network
 

diff --git a/x-pack/filebeat/module/panw/fields.go b/x-pack/filebeat/module/panw/fields.go
diff --git a/x-pack/filebeat/module/panw/panos/_meta/fields.yml b/x-pack/filebeat/module/panw/panos/_meta/fields.yml
@@ -61,6 +61,11 @@
               description: >
                 Post-NAT destination port.
 
+    - name: endreason
+      type: keyword
+      description: >
+        The reason a session terminated.
+
     - name: network
       type: group
       description: >

diff --git a/x-pack/filebeat/module/panw/panos/config/input.yml b/x-pack/filebeat/module/panw/panos/config/input.yml
@@ -101,6 +101,7 @@ processors:
         source.packets: 44
         server.packets: 45
         destination.packets: 45
+        panw.panos.endreason: 46
         observer.hostname: 52
 
   - extract_array: