# FortiGate Firewall

**URL:** <https://discuss.elastic.co/t/fortigate-firewall/129245>\
**Category:** Logstash\
**Created:** [April 24, 2018, 7:35am UTC](https://discuss.elastic.co/t/fortigate-firewall/129245 "2018-04-24T07:35:44Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![simmel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simmel/32/48040_2.png) [@simmel](https://discuss.elastic.co/u/simmel)\
**Post date:** [April 24, 2018, 8:26am UTC](https://discuss.elastic.co/t/fortigate-firewall/129245/6 "2018-04-24T08:26:02Z")

</div>

> Here is current config. I'm getting the logs but all have  
> \_grokparsefailure error. I am seeing whole "message" full of long  
> output.

No need to reinvent the wheel, use the `SYSLOGLINE` pattern from  
[https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/linux-syslog](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/linux-syslog)

> I would like to retrieve, dstip, srcip, srcport, dstport, geoip, etc.

I'd use the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html)  
with `include_keys`.

---

_[View the full topic](https://discuss.elastic.co/t/fortigate-firewall/129245)._