# Filebeat installation on FortiOS

**URL:** <https://discuss.elastic.co/t/filebeat-installation-on-fortios/244435>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 10, 2020, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-installation-on-fortios/244435 "2020-08-10T15:53:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\
**Post date:** [August 10, 2020, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-installation-on-fortios/244435/1 "2020-08-10T15:53:53Z")

</div>

Hi everyone!  
I'd like to use the Filebeat Fortinet module to send the firewall log files to my logstash server.  
However, I can't execute the cURL command mentioned in the Filebeat installation reference. I'm referring to this guide: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html)

The command line interface in FortiOS doesn't seem to support this command.  
Has anyone successfully installed Filebeat on FortiOS and if yes, how did you do it?

Any help is appreciated 🙂

---

<div class="post-metadata">

**Author:** ![rossw](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@rossw](https://discuss.elastic.co/u/rossw)\
**Post date:** [August 11, 2020, 10:13pm UTC](https://discuss.elastic.co/t/filebeat-installation-on-fortios/244435/2 "2020-08-11T22:13:05Z")

</div>

Hi there  
The Fortinet module is NOT installed on the Fortinet devices, but is enabled on the server where you are running your Filebeat instance (which may or may not be the same server where your Logstash is running). You still need to get your Fortinet devices to send their logs (using syslog) to a server, and then you have two choices:

1. you can get some form of syslog receiver to receive the syslogs from the Fortigates, and write them to a file, and then get the Filebeat to read from those files or
2. Have the Filebeat listen directly on the incoming network port for the syslog messages (either port 514 or a dedicated port for the Fortinet logs) and process them directly.

Good Luck

Ross

---

<div class="post-metadata">

**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\
**Post date:** [August 12, 2020, 10:19am UTC](https://discuss.elastic.co/t/filebeat-installation-on-fortios/244435/3 "2020-08-12T10:19:49Z")

</div>

Ok, that makes sense! Thank you so much for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2020, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-installation-on-fortios/244435/4 "2020-09-09T12:20:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.