# Fortigate Integrations
**URL:** https://discuss.elastic.co/t/fortigate-integrations/366211
**Category:** SIEM
**Created:** [September 8, 2024, 6:22pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211 "2024-09-08T18:22:02Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@arcsons](https://discuss.elastic.co/u/arcsons)
#### Post date: [September 8, 2024, 6:22pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/1 "2024-09-08T18:22:02Z")
Hi there,
I'm a beginner with Elastic and I'm trying to add the "Fortinet FortiGate Firewall Logs" integration to my Elastic setup. I have configured my firewall to send syslog messages to UDP port 9004 on host 192.168.1.200, where the Elastic Agent is installed.
I can see syslog traffic arriving using tcpdump, but I don't see any logs in my Elasticsearch. How can I verify that my Elastic Agent is sending traffic to Elasticsearch?
I did made this with tls cert, (for now.)
sudo ./elastic-agent install --url=httpX://192.168.1.200:8220 --enrollment-token=WGp4ajBwRUJfdVVXdnBPeG9EcDM6bTVpTnlMUEFTM21sNHlTRTgwa0tRdw== --insecure
Thanks for your help!
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 8, 2024, 8:18pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/2 "2024-09-08T20:18:53Z")
Hi @arcsons Welcome to the community.
There a couple next places to check.
Kibana -Stack Management - Data Streams
Look for fortigate data stream...
Then is should show number of indices... Click on that it should show if there are documents in the index...
Also try .. assuming you did not change the `dataset` or `namespace`
Kibana - Dev Tools
`GET logs-fortinet_fortigate.log-*/_search`
And see if there are any results.
You can also click on the
Fleet - Agent and it should show if the integration is healthy
---
### Author:  [@arcsons](https://discuss.elastic.co/u/arcsons)
#### Post date: [September 8, 2024, 9:43pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/3 "2024-09-08T21:43:09Z")
Hi Stephen, thanks for your replay 🙂
Stack Mangment / Index Mangement / Data Streams:
logs-fortinet\_fortigate.log-default
indices: 1
Storage size: 11.7mb
Health: Yellow
Stack Mangment / Index Mangement / Indices:
.ds-logs-fortinet\_fortigate.log-default-2024.09.08-000001
Health: Yellow
Status: Open
Docs:
18,788
Kibana - Dev Tools
GET logs-fortinet\_fortigate.log-\*/\_search
shows me 200 OK and some interesting stuff but not all.
Observability / Logs / Stream:
I see some errors in :
---
### Author:  [@arcsons](https://discuss.elastic.co/u/arcsons)
#### Post date: [September 8, 2024, 9:46pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/4 "2024-09-08T21:46:59Z")
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 8, 2024, 10:00pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/5 "2024-09-08T22:00:54Z")
First please do not post images of text... please paste the text and formate with with 2 backticks ````` before and after ...images can not be searched debugged etc.. some people can not see them.
This
> [@arcsons](#):
>
> .ds-logs-fortinet\_fortigate.log-default-2024.09.08-000001
> Health: Yellow
> Status: Open
and this show you are ingesting data....
> [@arcsons](#):
>
> GET logs-fortinet\_fortigate.log-\*/\_search
> shows me 200 OK and some interesting stuff but not all.
When I ask for this please provide some of the sample results... not just "Some interesting stuff" otherwise I can not help...
Please post a few of those results...
You probably have a timezone issue... please see this post...
> [@Elastic Search have index file and i can add it to Kibana but is said no data](https://discuss.elastic.co/t/elastic-search-have-index-file-and-i-can-add-it-to-kibana-but-is-said-no-data/365862/7):
>
> @D_Nang_Kien Please do not share text as screen shots it is very hard to work with... Most likely, you are writing data without a timezone, so the data is in the "future" ... you will need to account for that All Data is stored in UTC in Elastic. If you send data from your timezone and do not provide the timezone the data will be captured and stored as UTC... What timezone are you in? Rerun the generator. Go to the Time Picker...and set exactly this and show me what you see.... and set t…
Set the time picker in Discover to 24 hours ago to 24 hours to now... and see if you have results... I am sure you do.
######################################
The other logs error logs...
What are you doing with logstash?... this is why do not paste image of text... I can not help much... This is probably not the issue with the fortigate logs... but whatever you are doing with logstasth it is trying to connect to Elasticsearch at the default address... `http://localhost:9200` which above is probably not correct...
I would think you are trying to do
Fortigate -\> UDP Elastic Agent -\> Elasticsearch
Or are you trying
Fortigate -\> UDP Elastic Agent -\> Logstash -\> Elasticsearch
If so why?
---
### Author:  [@arcsons](https://discuss.elastic.co/u/arcsons)
#### Post date: [September 9, 2024, 9:54am UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/6 "2024-09-09T09:54:15Z")
Ok nice it works after change the Timezone settings.
Yes, I understand about the image and the text.
I apologize for my beginner questions, but I would really appreciate your help with the following:
1. Can I get the dashboard titled “[Fortinet Fortigate] Firewall Overview” directly under Security Views instead of having it under Custom Dashboards?
2. How can I add panels to the dashboard? I can’t seem to find anywhere to edit it.
3. If I want to perform a free text search, where should I go? I want it within Security; I know there are tabs for Search, Observability, and Analytics. Is it just in Analytics -\> Discover?
4. In the logs I receive from the firewall, I only see "agent.name X," where X is the name of my Linux server hosting the agent. I don’t see the name of the firewall; it should be "fw-home" somewhere.
5. If I add another firewall, should I use this existing agent, right? Then its important to have a firewall name like the mention in 4. question.
I must say, this is a really nice product. Thanks again!
---
### Author:  [@arcsons](https://discuss.elastic.co/u/arcsons)
#### Post date: [September 11, 2024, 9:35pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/7 "2024-09-11T21:35:50Z")
Please anyone?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 12, 2024, 4:03am UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/8 "2024-09-12T04:03:12Z")
1. No, not as far as I know.. those are "Curated Views"
2. The OOTB Dashboards are "Managed" so Duplicate the Dashboard then you can edit
3. Yes Discover, but you can save your search as a Saved Search and then add to a Custom Dashboard
4. Here are all the fields... You need to look at
[Fortinet FortiGate Firewall Logs | Documentation](https://www.elastic.co/docs/current/integrations/fortinet_fortigate)
You will need to check and see which field refers the to actual firewall source it may require setting on the fortgate side... not my expertise... BUT you certainly you add fields or tags per integrations to identify / set what you like
`log.source.address` look like the IP that is forwarding the FW Logs aka the firewall (unless you are using a syslog forwarder)
1. With respect to the number of Agents that depends on the Volume you can assign 2 fortigate fw integrations to single policy / agent... very flexible...
---
### Author:  [@arcsons](https://discuss.elastic.co/u/arcsons)
#### Post date: [September 12, 2024, 6:36pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/9 "2024-09-12T18:36:51Z")
Thanks alot 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 10, 2024, 6:37pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211/10 "2024-10-10T18:37:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.