# Filebeat Fortinet Default Ingest Pipeline fails **URL:** \ **Category:** Beats\ **Created:** [June 26, 2020, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893 "2020-06-26T17:41:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mercwri](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@Mercwri](https://discuss.elastic.co/u/Mercwri)\ **Post date:** [June 26, 2020, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/1 "2020-06-26T17:41:38Z")
I have multiple Fortinet devices pushing logs to a collector running Filebeat 7.8.0 with the Fortinet module enabled. All of the logs are being ingested but the pipeline fails at decoding/normalizing the timestamps. I get the following error: Text '2020-06-26 13:39:00Z' could not be parsed, unparsed text found at index 19 It appears to be an issue with how the \_temp.time field is processed by the Ingest Pipeline but I have not to been able to isolate the issue. ---
**Author:** ![Derick\_Jansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/derick_jansen/32/71407_2.png) [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Post date:** [June 30, 2020, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/2 "2020-06-30T22:45:15Z")
I have the same issue. What version of the FortiOS firmware are you running? ---
**Author:** ![tdanno](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@tdanno](https://discuss.elastic.co/u/tdanno)\ **Post date:** [July 6, 2020, 12:47pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/3 "2020-07-06T12:47:18Z")
I'm having the same issue and error message with the time stamp normalizing, on FortiOS 6.2 . Also, the fields are coming through as all 'fortinet.firewall.' instead of the proper ECS equivalent. i.e., instead of 'source.ip' I'm getting 'fortinet.firewall.srcip' . ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [July 14, 2020, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/4 "2020-07-14T13:47:47Z")
@Mercwri @Derick_Jansen @tdanno Could anyone provide a log sample? I have merged some changes for timestamp parsing that should be included in the next release. Ref: [https://github.com/elastic/beats/issues/19154](https://github.com/elastic/beats/issues/19154) [https://github.com/elastic/beats/issues/19010](https://github.com/elastic/beats/issues/19010) [https://github.com/elastic/beats/issues/18707](https://github.com/elastic/beats/issues/18707) If you want to test it, you can modify the pipeline.yml or the pipeline on elasticsearch with the changes here: > If you look at the date processors here they might have added a third format or something similar to support this. ---
**Author:** ![Mercwri](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@Mercwri](https://discuss.elastic.co/u/Mercwri)\ **Post date:** [July 14, 2020, 2:12pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/5 "2020-07-14T14:12:50Z")
The revised pipeline appears to have resolved the timestamp processing. ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [July 14, 2020, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/6 "2020-07-14T14:28:45Z")
Thanks for confirming! 😁 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 11, 2020, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893/7 "2020-08-11T16:29:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.