FILEBEAT module Fortinet : Provided Grok expressions do not match field value

Elastic Stack Beats
,
4

Hello again @Alex_Lum :slight_smile:

Ah so that explains it. The TLS and TCP actually uses a totally different way to communicate when it comes from fortinet, support for tcp and tls was added in 7.12 here: [Filebeat] rfc6587 framing for fortinet firewall by leehinman 路 Pull Request #23837 路 elastic/beats 路 GitHub

So if you use the 7.12 version, and set the input type to tcp and configure the TLS settings it should work just fine :slight_smile:

Something like this in the fortinet.yml under the firewall module, together with the rest of your settings, though remove things like client auth if its not used:

ssl:
  enabled: true
  certificate: "foo.crt"
  key: "foo.key"
  client_authentication: true
  verification_mode: true # or none if it shouldn't check the hostname of the cert