# Fortinet module not parsing from file

**URL:** <https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 20, 2021, 10:36pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590 "2021-05-20T22:36:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mustafa\_Y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa_y/32/89050_2.png) [@Mustafa\_Y](https://discuss.elastic.co/u/Mustafa_Y)\
**Post date:** [May 20, 2021, 10:36pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/1 "2021-05-20T22:36:22Z")

</div>

Hello,

I want to parse fortinet logs from file instead of syslog network. There is an option `var.paths` in [Fortinet module | Filebeat Reference [master] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/master//filebeat-module-fortinet.html) and `var.input` . I configured it as below:

```
- module: fortinet

```

firewall:  
enabled: true

```
var.paths:
    - /home/vagrant/shared/fortigate.log
    # Set which input to use between tcp, udp (default) or file.
    var.input: file

```

And I am writing some log lines to fortigate.log file with a script however it is not parsing message part.  
This is sample raw log I am appending as a new line to fortigate.log

```auto
date=2017-11-15 time=11:44:16 logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" eventtime=1510775056 srcip=10.1.100.155 srcname="pc1" srcport=40772 srcintf="port12" srcintfrole="undefined" dstip=35.197.51.42 dstname="fortiguard.com" dstport=443 dstintf="port11" dstintfrole="undefined" poluuid="707a0d88-c972-51e7-bbc7-4d421660557b" sessionid=8058 proto=6 action="close" policyid=1 policytype="policy" policymode="learn" service="HTTPS" dstcountry="United States" srccountry="Reserved" trandisp="snat" transip=172.16.200.2 transport=40772 appid=40568 app="HTTPS.BROWSER" appcat="Web.Client" apprisk="medium" duration=2 sentbyte=1850 rcvdbyte=39898 sentpkt=25 rcvdpkt=37 utmaction="allow" countapp=1 devtype="Linux PC" osname="Linux" mastersrcmac="a2:e9:00:ec:40:01" srcmac="a2:e9:00:ec:40:01" srcserver=0 utmref=0-220586

```

This is the output of filebeat:

```auto
    {
  "@timestamp": "2021-05-20T21:53:12.537Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "7.12.1",
    "pipeline": "filebeat-7.12.1-fortinet-firewall-pipeline"
  },
  "message": "date=2017-11-15 time=11:44:16 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"vdom1\" eventtime=1510775056 srcip=10.1.100.155 srcname=\"pc1\" srcport=40772 srcintf=\"port12\" srcintfrole=\"undefined\" dstip=35.197.51.42 dstname=\"fortiguard.com\" dstport=443 dstintf=\"port11\" dstintfrole=\"undefined\" poluuid=\"707a0d88-c972-51e7-bbc7-4d421660557b\" sessionid=8058 proto=6 action=\"close\" policyid=1 policytype=\"policy\" policymode=\"learn\" service=\"HTTPS\" dstcountry=\"United States\" srccountry=\"Reserved\" trandisp=\"snat\" transip=172.16.200.2 transport=40772 appid=40568 app=\"HTTPS.BROWSER\" appcat=\"Web.Client\" apprisk=\"medium\" duration=2 sentbyte=1850 rcvdbyte=39898 sentpkt=25 rcvdpkt=37 utmaction=\"allow\" countapp=1 devtype=\"Linux PC\" osname=\"Linux\" mastersrcmac=\"a2:e9:00:ec:40:01\" srcmac=\"a2:e9:00:ec:40:01\" srcserver=0 utmref=0-220586",
  "input": {
    "type": "log"
  },
  "agent": {
    "version": "7.12.1",
    "hostname": "vagrant",
    "ephemeral_id": "f0221863-6941-46ec-9efc-b9255ee465fd",
    "id": "90241210-096b-4b18-8a3e-2d6ac8fbfe27",
    "name": "vagrant",
    "type": "filebeat"
  },
  "log": {
    "offset": 49175,
    "file": {
      "path": "/home/vagrant/shared/fortigate.log"
    }
  },
  "tags": [
    "fortinet-firewall",
    "forwarded"
  ],
  "service": {
    "type": "fortinet"
  },
  "event": {
    "module": "fortinet",
    "dataset": "fortinet.firewall"
  },
  "fileset": {
    "name": "firewall"
  },
  "ecs": {
    "version": "1.8.0"
  }
}

```

How should I configure it to make fortinet module to parse it properly? And also note that I am not writing filebeat outputs to logstash or elasticsearch, configured a file as output and seeing same transformed json above in debug mode as well.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [May 21, 2021, 3:22am UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/2 "2021-05-21T03:22:49Z")

</div>

Can u post the logs from filebeat? Did u install the ingest pipelines?

---

<div class="post-metadata">

**Author:** ![Mustafa\_Y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa_y/32/89050_2.png) [@Mustafa\_Y](https://discuss.elastic.co/u/Mustafa_Y)\
**Post date:** [May 21, 2021, 11:47am UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/3 "2021-05-21T11:47:43Z")

</div>

Which logs did you mean, /var/log/filebeat/filebeat? For the second question if you mean 'filebeat setup --pipelines --modules fortinet' yes I ran it but remember as I stated in the first post I am not sending logs from filebeat to logstash or elasticsearch, I simpyl read from file and write to file using option below in filebeat.yml

```auto
output.file:
  path: "/home/vagrant/shared/"
  filename: testout

```

Output for elasticsearch and logstash is disabled.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [May 21, 2021, 12:03pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/4 "2021-05-21T12:03:10Z")

</div>

Ok I missed that. All the parsing and enrichment is happening in the ingest pipeline, not locally in filebeat?

---

<div class="post-metadata">

**Author:** ![Mustafa\_Y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustafa_y/32/89050_2.png) [@Mustafa\_Y](https://discuss.elastic.co/u/Mustafa_Y)\
**Post date:** [May 21, 2021, 12:17pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/5 "2021-05-21T12:17:55Z")

</div>

I didn't understand, is not the parsing operation performed by filebeat itself? I created different pipelines like using gsuite for example with logstash and there was not problem, there was not any filter or remapping configuration on logstash everything was fine. Is there an internal communication between filebeat and logstash where the parsing is performed on logstash side and if it is so, is it same for all filebeat modules?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [May 21, 2021, 12:23pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/6 "2021-05-21T12:23:16Z")

</div>

No some modules do the majority of the processing locally and some do all of it on the ingest pipeline side.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2021, 2:23pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590/7 "2021-06-18T14:23:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.