# Kv filter - Fortigate Logs
**URL:** https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281
**Category:** Logstash
**Created:** [October 25, 2017, 5:51pm UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281 "2017-10-25T17:51:11Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dev\_disola](https://discuss.elastic.co/u/dev_disola)
#### Post date: [October 25, 2017, 5:51pm UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281/1 "2017-10-25T17:51:11Z")
Hello everyone,
I met ELK a short time ago and started to analyze logs generated from a Fortigate switch. The message is coming in the following format:
`<189>date = 2017-10-25 time = 14:25:25 devname = ELSEN01 ...`
I'm able to separate all tuples (key / value), but this beginning keeps coming in as a unique variable:
`<189>date => October 24th 2017, 21:00:00.000`
I would like a opnion of someone who understands Kv to help me separate this into two variables:
```
syslog_index => 189
date => October 24th 2017
```
Thanks =D
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 26, 2017, 5:26am UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281/2 "2017-10-26T05:26:47Z")
Use a grok filter before your kv filter to separate the `` prefix from the rest of the string.
```
^<%{INT:syslog_index}>%{GREEDYDATA:message}
```
You'll probably have to set the grok filter's `overwrite` option.
(`syslog_index` is a weird field name.)
---
### Author:  [@dev\_disola](https://discuss.elastic.co/u/dev_disola)
#### Post date: [October 26, 2017, 11:28pm UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281/3 "2017-10-26T23:28:05Z")
Thanks for the reply @magnusbaeck,
> [@magnusbaeck](#):
>
> Use a grok filter before your kv filter to separate the \ prefix from the rest of the string.
Oh, this filter GROK is very interesting, I did not know it! From what I read on the site, it manages to fill some holes that KV can not handle, and that's probably going to work! Unfortunately, I can't test this solution now, but tomorrow I will return with news!
> [@magnusbaeck](#):
>
> (syslog\_index is a weird field name.)
in fact is a bad name 😂 , this solution comes from the fortigate itself and has the function of identifying an event based on the type -\> subtype -\> level, but I will think of an alternative name haha
Thanks for all help!
---
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [October 26, 2017, 11:46pm UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281/4 "2017-10-26T23:46:55Z")
\<189\>
I thought the above field is the priority from which you can calculate the Facility and Severity, so maybe Priority would be a suitable name
189 / 8 = 23.625
Facility is 23
189 - (23 x 8) = 5
Severity is 5 (Error)
---
### Author:  [@dev\_disola](https://discuss.elastic.co/u/dev_disola)
#### Post date: [October 27, 2017, 12:03am UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281/5 "2017-10-27T00:03:36Z")
> [@VamPikmin](#):
>
> I thought the above field is the priority from which you can calculate the Facility and Severity...
Um, now you've left me in doubt @VamPikmin! I just start to work with fortigate and i do not know it very well, so I may have confused, but I will try to confirm this information!
> [@VamPikmin](#):
>
> ...so maybe Priority would be a suitable name
I like that, definitely a more appropriate name!
Thank you anyway!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 24, 2017, 12:04am UTC](https://discuss.elastic.co/t/kv-filter-fortigate-logs/105281/6 "2017-11-24T00:04:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.