# Fortigate integration with ELK **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [October 21, 2021, 1:56pm UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323 "2021-10-21T13:56:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Hamzah](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hamzah](https://discuss.elastic.co/u/Hamzah)\ **Post date:** [October 21, 2021, 1:56pm UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323/1 "2021-10-21T13:56:02Z")
Hi, I am trying to integrate fortigate with Elasticstack. What should be the optimal solution for this integration? 1- Should I use logstash, send fortigate logs to logstash and parse them. 2- Should I use filebeat server, send fortigate logs to this server and use fortinet module to parse. 3- Setup filebeat in fortigate to ship logs directly to stack. 4- Or others What options are recommended by ELK and what community is using? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 21, 2021, 2:39pm UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323/2 "2021-10-21T14:39:54Z")
I would said that it depends on your infrastructure and what you need to do what the logs. For example, I collect log from a couple of Fortigate devices, I use logstash instead of filebeat because filebeat does not have the flexibility I need for enriching the data as I use a couple of `translate` and `memcached` filters. In my use case I have the fortigate devices configured to send logs to a `udp` port as it was sending to a syslog, on this port I have a logstash pipeline listening that sends this data to a Kafka cluster, then I have other logstash consuming from this Kafka, I use this structure because of the number of events per second. Fortigate logs are pretty easy to parse, you can use a combination of the `dissect` filter and a `kv` filter to parse it. ---
**Author:** ![Hamzah](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hamzah](https://discuss.elastic.co/u/Hamzah)\ **Post date:** [October 21, 2021, 5:37pm UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323/3 "2021-10-21T17:37:43Z")
Thank you for responding. This answers my question. One question though, if we use logstash, how will you troubleshoot if you are not receiving logs, can we create any alert on that. ---
**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\ **Post date:** [October 26, 2021, 9:27am UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323/4 "2021-10-26T09:27:34Z")
Hi @Hamzah - the Elastic Agent + Fortigate integration is another option and incredibly easy to configure. You can simply deploy the Elastic Agent on an intermediary host which is used to send the data to Elastic. The Fortigate integration can then be enabled to automatically parse your events and map to ECS. You can view the relevant integration docs [here](https://docs.elastic.co/en/integrations/fortinet). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 23, 2021, 11:27am UTC](https://discuss.elastic.co/t/fortigate-integration-with-elk/287323/5 "2021-11-23T11:27:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.