Fortinet module processor fail

Elastic Stack Beats
1

Hi,

I'm configuring Fortinet module but processor condition added doesn't work and I don't understand why.

Here you have config module :

- module: fortinet    
  firewall:    
    enabled: true    
    var.input: udp    
    var.syslog_host: 0.0.0.0    
    var.syslog_port: 9999    
    input:                                                                                                                                                                                                                                       
      processors:    
      - add_tags:    
         when:    
            contains:    
               observer.name: "TEST"    
         tags: [test]

If I remove when condition, the tag is created.

Do you have an idea on what I made wrong ?

Best regards,

Thomas

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.