I'm trying out fortinet filebeat plugin. Running ELK with 7.10.1 and filebeat 7.10.1
However, I'm getting a strange input values into the documents (in the filebeat-* index)
This is my config
- module: fortinet firewall: enabled: true # Set which input to use between tcp, udp (default) or file. var.input: udp # The interface to listen to syslog traffic. Defaults to # localhost. Set to 0.0.0.0 to bind to all available interfaces. var.syslog_host: 10.60.1.201 # The port to listen for syslog traffic. Defaults to 9004. var.syslog_port: 9004 input: processors: - add_fields: target: '' fields: fortinet.firewall.tz: '+800'
The question is why am I getting the "tmp" part of every data line?
And how do I fix it?
I've verified that the pipelines exist
This is the pipeline that does the rename from fortinet.tmp to fortinet.firewall.
But for some reason its not running.
Thanks in advance.