# Firewall logs to different Datastream by type

**URL:** <https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211>\
**Category:** SIEM\
**Created:** [April 16, 2025, 4:52pm UTC](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211 "2025-04-16T16:52:42Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 16, 2025, 10:50pm UTC](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211/21 "2025-04-16T22:50:59Z")

</div>

Yup policy with ONLY fortigate fails

```auto
[indices:admin/auto_create] is unauthorized for API key id [qh3IQJYBq5b1-O15jq2H] of user [elastic/fleet-server] on indices [logs-fortinet_fortigate.log_custom-newnamespace],

```

When I add the Azure Logs... works

Interesting workaround....

Seem like the permissions could be

`logs-fortigate.*-*` or go ahead and expand to `logs-fortigate.<event_type>-*`

Thanks for the chat

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 17, 2025, 2:09am UTC](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211/22 "2025-04-17T02:09:46Z")

</div>

Yeah, the Agent permissions are pretty limited at the moment, but this will change on version 9.1 it seems.

This PR adds some UI to configure extra permissions: [[Fleet] Add UI to add additional datastreams permissions by nchaulet · Pull Request #210935 · elastic/kibana · GitHub](https://github.com/elastic/kibana/pull/210935)

But in this specific case, and also in the case of other network devices like Palo Alto, the definitive solution is to change the integration and add different data streams for different datasets.

---

<div class="post-metadata">

**Author:** ![juancamiloll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juancamiloll/32/110326_2.png) [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\
**Post date:** [April 24, 2025, 12:57pm UTC](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211/23 "2025-04-24T12:57:39Z")

</div>

Thanks to both of you for your comments, the truth is that I got lost, I only understood as far as I was told that it was not possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2025, 12:58pm UTC](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211/24 "2025-05-22T12:58:06Z")

</div>

Closed on May 22, 2025, 12:58pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211.md?page=1)