# Can't ingest from Fortigate

**URL:** <https://discuss.elastic.co/t/cant-ingest-from-fortigate/200861>\
**Category:** Elasticsearch\
**Created:** [September 24, 2019, 12:21pm UTC](https://discuss.elastic.co/t/cant-ingest-from-fortigate/200861 "2019-09-24T12:21:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhmariscal](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jhmariscal](https://discuss.elastic.co/u/jhmariscal)\
**Post date:** [September 24, 2019, 12:21pm UTC](https://discuss.elastic.co/t/cant-ingest-from-fortigate/200861/1 "2019-09-24T12:21:58Z")

</div>

I am new to elastic, so any help would be appreciated. I have a gotten ELK working and a basic WinloginBeat to work from a DC. Trying to get Fortigate traffic into Elastic.

I am running FortiOS v6.2.1 build0932 (GA)

My Syslog settings on the Fortigate look like this:  
FGT60D461xxxxxxxx (setting) # get  
status : enable  
server : 192.168.10.xxx  
mode : udp  
port : 514  
facility : local0  
source-ip : 192.168.10.xxx  
format : default

Config file built here:  
/etc/logstash/conf.d/Forti60E.conf

input {  
udp {  
port =\> 514 #whatever port you have define change this  
type =\> "forti\_log"  
}  
}

filter {  
if [type] == "forti\_log" {

grok {  
match =\> ["message", "%{SYSLOG5424PRI:syslog\_index}%{GREEDYDATA:message}"]  
overwrite =\> ["message"]  
tag\_on\_failure =\> ["forti\_grok\_failure"]  
}

```
kv {

```

source =\> "message"  
value\_split =\> "="  
field\_split =\> ","

}

mutate {  
add\_field =\> { "temp\_time" =\> "%{date} %{time}" }  
rename =\> { "type" =\> "ftg\_type" }  
rename =\> { "subtype" =\> "ftg\_subtype" }  
add\_field =\> { "type" =\> "forti\_log" }  
convert =\> { "rcvdbyte" =\> "integer" }  
convert =\> { "sentbyte" =\> "integer" }

}

date {  
match =\> ["temp\_time", "yyyy-MM-dd HH:mm:ss"]  
timezone =\> "UTC" #change with your timestamp  
target =\> "@timestamp"  
}

mutate {  
remove\_field =\> ["syslog\_index","syslog5424\_pri","path","temp\_time","service","date","time","sentpkt","rcvdpkt","log\_id","message","poluuid"]

}  
}  
}

output {  
stdout { codec =\> rubydebug }  
if [type] == "forti\_log" {  
elasticsearch {  
hosts =\> "192.168.10.212:9200" #change with your elastic ip  
http\_compression =\> "true"  
index =\> "forti-%{+YYYY.MM.dd}"  
user =\> "elastic"  
password =\> "elastic"  
template =\> "/usr/share/logstash/bin/forti.json"  
template\_name =\> "forti-\*"  
}  
}  
}

Then I have this file here:

/usr/share/logstash/bin/forti.json

{  
"template" : "forti- _",  
"version" : 50001,  
"settings" : {  
"index.refresh\_interval" : "5s"  
},  
"mappings" : {  
" default " : {  
"\_all" : {"enabled" : true, "omit\_norms" : false},  
"dynamic\_templates" : [ {  
"message\_field" : {  
"path\_match" : "message",  
"match\_mapping\_type" : "string",  
"mapping" : {  
"type" : "text",  
"omit\_norms" : false  
}  
}  
}, {  
"string\_fields" : {  
"match" : "_ ",  
"match\_mapping\_type" : "string",  
"mapping" : {  
"type" : "text", "omit\_norms" : false,  
"fields" : {  
"keyword" : { "type": "keyword", "ignore\_above": 256 }  
}  
}  
}  
} ],  
"properties" : {  
"@timestamp": { "type": "date", "include\_in\_all": false },  
"@version": { "type": "keyword", "include\_in\_all": false },  
"geoip" : {  
"dynamic": true,  
"properties" : {  
"ip": { "type": "ip" },  
"location" : { "type" : "geo\_point" },  
"latitude" : { "type" : "half\_float" },  
"longitude" : { "type" : "half\_float" }  
}  
},  
"location": { "type": "geo\_point" }  
}  
}  
}  
}

Then ran:

# sudo systemctl stop logstash.service

# sudo systemctl Start logstash.service

Not getting anything in Kibana. Where should I be looking to errors/ logs?

---

<div class="post-metadata">

**Author:** ![jhmariscal](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jhmariscal](https://discuss.elastic.co/u/jhmariscal)\
**Post date:** [September 24, 2019, 12:26pm UTC](https://discuss.elastic.co/t/cant-ingest-from-fortigate/200861/2 "2019-09-24T12:26:17Z")

</div>

One update- I read somewhere (dont remember where I got this note) that logs would be here:

/var/log/fortigate/\*.log

but when I look in /var/log/, I dont ahve a fortigate folder. Any help?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 12:26pm UTC](https://discuss.elastic.co/t/cant-ingest-from-fortigate/200861/3 "2019-10-22T12:26:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.