# Fortinet message field not being parsed correctly

**URL:** <https://discuss.elastic.co/t/fortinet-message-field-not-being-parsed-correctly/247236>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 2, 2020, 1:05pm UTC](https://discuss.elastic.co/t/fortinet-message-field-not-being-parsed-correctly/247236 "2020-09-02T13:05:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tocheeba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tocheeba/32/22942_2.png) [@tocheeba](https://discuss.elastic.co/u/tocheeba)\
**Post date:** [September 2, 2020, 1:05pm UTC](https://discuss.elastic.co/t/fortinet-message-field-not-being-parsed-correctly/247236/1 "2020-09-02T13:05:04Z")

</div>

I've been trying to get this working for the past 3 weeks, and have read literally every forum post, reddit post, etc., on this. I'm spinning my wheels and can't figure out what is going wrong.

I've tried using Filebeats--\>ES with the Fortinet plugin, and Filebeats--\>Logstash--\>ES, and both result in the same thing. I see data, but the 'message' field isn't parsed, so I can't visualize anything worthwhile.

Here is my Fortinet syslog setup:

```
config log syslogd2 setting
    set status enable
    set server "10.100.11.50"
    set mode reliable
    set port 5513
    set facility local7
    set source-ip 0.0.0.0
    set format default
    set priority default
    set max-log-rate 0
    set enc-algorithm disable
    set interface-select-method auto
end

config log syslogd2 filter
    set severity information
    set forward-traffic enable
    set local-traffic enable
    set multicast-traffic enable
    set sniffer-traffic enable
    set anomaly enable
    set voip enable
    set filter ''
    set filter-type include
end

```

Filebeat Config (going to ES)

```
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

```

Filebeat Config (when going to Logstash):

```
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5522"]

```

Logstash Config:

```
input {
  beats {
    port => 5522
  }
}

output {
  elasticsearch {
    pipeline => "%{[@metadata][pipeline]}"
    hosts => ["localhost:9200"]
    index => "fortios-%{+YYYY.MM.dd}"
  }
}

```

Pipelines were injected just fine:

 ![filebeat0a](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38a59d262ce3391b72f6e55a07b37d2fa4115d8b.png)

Fields are populating, but 'messages' isn't parsed out:

 ![uPExaCK](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70f95908be1ca9b8265518f7cb226c71b1a64005.png)

Also, probably unrelated, but even the fields/message data is just showing information for one machine - the syslog/ELK server. Based on my config, I'd imagine that ALL logs from all traffic/machines should be being sent. It's just data for this one machine - not sure why. Message field still not parsed, but there should be a LOT more data flowing through too.

Not sure what I'm missing. Any suggestions/ideas? I'm completely lost.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 30, 2020, 3:05pm UTC](https://discuss.elastic.co/t/fortinet-message-field-not-being-parsed-correctly/247236/2 "2020-09-30T15:05:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.