# FortiGate Firewall

**URL:** https://discuss.elastic.co/t/fortigate-firewall/129245
**Category:** Logstash
**Created:** [April 24, 2018, 7:35am UTC](https://discuss.elastic.co/t/fortigate-firewall/129245 "2018-04-24T07:35:44Z")
**Posts on this page:** 1
**Showing post:** 9

<div class="post-metadata">

### Author: ![lcguy](https://avatars.discourse-cdn.com/v4/letter/l/35a633/32.png) [@lcguy](https://discuss.elastic.co/u/lcguy)
#### Post date: [April 24, 2018, 8:49am UTC](https://discuss.elastic.co/t/fortigate-firewall/129245/9 "2018-04-24T08:49:45Z")

</div>

Works with following config now. Seems like error in kv. After I comment out kv, all works.  
Do I need to install something to work with kv filter?

input {  
udp {  
port =\> 5514  
type =\> "syslog"  
}  
}

filter {  
mutate {  
gsub =\>  
["message", ": ", ":",  
"message", "^\<[0-9][0-9][0-9]\>", ""]  
}

#kv {

# field\_split =\> ""," "

# source =\> "message"

# add\_field =\> ["sourcetime", "%{date}:%{time}"]

# }

#date { match =\> ["sourcetime","yyyy-MM-dd:HH:mm:ss"]}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

---

_[View the full topic](https://discuss.elastic.co/t/fortigate-firewall/129245)._