# Filebeat Fortinet Firewall Module 7.15.1 **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 19, 2021, 3:16am UTC](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046 "2021-10-19T03:16:35Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![unknown\_user](https://avatars.discourse-cdn.com/v4/letter/u/ac91a4/32.png) [@unknown\_user](https://discuss.elastic.co/u/unknown_user)\ **Post date:** [October 19, 2021, 3:16am UTC](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046/1 "2021-10-19T03:16:35Z")
I just started using filebeat fortinet module and noticed that the module failed to split the fields on a fortigate 6.4.7 I've resolved the issue by changing, ```auto field_split: " (?=[a-z\\_\\-]+=)" ``` to ```auto field_split: ",(?=[a-z\\_\\-]+=)" ``` Unsure if this is a known issue or are the format of my logs different from whats expected? Log sample: ```auto date=2021-10-19,time=13:24:58,devname="######",devid="###########",eventtime=1634610298318004656,tz="+1100",logid="0000000013",type="traffic",subtype="forward",level="notice",vd="####",srcip=#####,srcport=54334,srcintf="port5",srcintfrole="wan",dstip=######,dstport=51###,dstintf="##",dstintfrole="wan",srccountry="Korea, Republic of",dstcountry="Australia",sessionid=319025746,proto=17,action="deny",policyid=0,policytype="policy",service="udp/51562",trandisp="noop",duration=0,sentbyte=0,rcvdbyte=0,sentpkt=0,appcat="unscanned",crscore=30,craction=131072,crlevel="high" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 16, 2021, 5:17am UTC](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046/2 "2021-11-16T05:17:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.