# Configuration fortigate with filebeat

**URL:** <https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 5, 2024, 3:03am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421 "2024-01-05T03:03:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dy\_Vanrith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dy_vanrith/32/130209_2.png) [@Dy\_Vanrith](https://discuss.elastic.co/u/Dy_Vanrith)\
**Post date:** [January 5, 2024, 3:03am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/1 "2024-01-05T03:03:49Z")

</div>

Hello i have project that work with fortigate and filebeat  
i want to collect sys\_log from fortigate into filebeat  
my configuration

## fortigate

## config log syslogd setting set status enable set server filebeat\_server set mode reliable next end

## filebeat

- type: syslog  
enabled: true  
host: ":"  
protocol.udp:  
max\_message\_size: 10MiB

* * *

but it look like not work as well as

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 5, 2024, 10:53pm UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/2 "2024-01-05T22:53:44Z")

</div>

Which FB version are you using?  
Have you enabled the [fortinet](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-fortinet.html) module?  
`filebeat modules enable fortinet`

If you still want pure syslog:

```auto
filebeat.inputs:
- type: syslog
  enabled: true
  format: auto
  protocol.udp:
    host: "0.0.0.0:514"

```

For test purpose,until data is received, you can set the console output:

```auto
output.console:
  pretty: true

```

Make sure that your data is coming to the FB host.  
`netstat -ulpn | grep ':<portnum>'`

---

<div class="post-metadata">

**Author:** ![Dy\_Vanrith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dy_vanrith/32/130209_2.png) [@Dy\_Vanrith](https://discuss.elastic.co/u/Dy_Vanrith)\
**Post date:** [January 12, 2024, 8:31am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/3 "2024-01-12T08:31:21Z")

</div>

My file beat using version 8.10.3.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 12, 2024, 9:10am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/4 "2024-01-12T09:10:57Z")

</div>

That is relatively new, shouldn't be issues.

Set correct filebeat.yml and make sure that the traffic is coming to the FB host

---

<div class="post-metadata">

**Author:** ![Dy\_Vanrith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dy_vanrith/32/130209_2.png) [@Dy\_Vanrith](https://discuss.elastic.co/u/Dy_Vanrith)\
**Post date:** [January 12, 2024, 9:18am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/5 "2024-01-12T09:18:34Z")

</div>

## I want to confirm from you again. my fortigate config is

## config log syslogd setting set status enable set server filebeat\_server set mode reliable next end

## and filebeat.yml

filebeat.inputs:

- type: syslog  
enabled: true  
format: auto  
protocol.udp:  
host: "0.0.0.0:514"

output.console:  
pretty: true

and for me i make sure that traffic that send from fortigate must be listen by filebeat right?

Thanks u in advance!!

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 12, 2024, 10:11am UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/6 "2024-01-12T10:11:51Z")

</div>

> [@Dy\_Vanrith](#):
>
> mode reliable

This means it will send over TCP.

Change in filebeat.yml:

```auto
filebeat.inputs:
- type: syslog
  enabled: true
  format: auto
  protocol.tcp:
    host: "0.0.0.0:514"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2024, 12:11pm UTC](https://discuss.elastic.co/t/configuration-fortigate-with-filebeat/350421/7 "2024-02-09T12:11:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.