Is there a way to correlate FortiGate logs?

[meatwad]

Hi there,

I'm ingesting logs from our Fortinet FortiGate VPN server and was wondering if there's a way to correlate login sessions.

The issue I'm trying to solve for is that the logs that show a successful login don't include the source.geo.country_name field and the logs that do have that field don't have any user related data.

There's a fortinet.firewall.sessionid field but it doesn't correlate the actual login session. For example, this is from one of my recent logins:

And the fortinet.firewall.sessionid field isn't even present in the logs that the successful logins:

If anyone has any suggestions, I'd love to know!

Thank you!

[dot-mike]

Check my post Best practice for adding additional fields to transform and try creating a transformation. It duplicate the VPN sessions to a new index with start & stop time...