# Parsing Error in Fortinet-Module Pipeline blasts up message log

**URL:** <https://discuss.elastic.co/t/parsing-error-in-fortinet-module-pipeline-blasts-up-message-log/241411>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 16, 2020, 8:03am UTC](https://discuss.elastic.co/t/parsing-error-in-fortinet-module-pipeline-blasts-up-message-log/241411 "2020-07-16T08:03:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [July 16, 2020, 8:03am UTC](https://discuss.elastic.co/t/parsing-error-in-fortinet-module-pipeline-blasts-up-message-log/241411/1 "2020-07-16T08:03:12Z")

</div>

Hey guys,

First of a few details about my cluster:

Cluster of 3 Servers - 1xMaster 2xData Nodes  
All of them are running ES 7.8 Filebeat 7.8 (ofc Kibana as well on the master node)  
OS: CentOS 7 (Kernel 3.10.0-957)  
I noticed that there now was a Fortinet Module within Filbeat - and i decided to try it out.

Fortinet Config:

```
- module: fortinet
  firewall:
    enabled: true

    # Set which input to use between tcp, udp (default) or file.
    var.input: udp

    # The interface to listen to syslog traffic. Defaults to
    # localhost. Set to 0.0.0.0 to bind to all available interfaces.
    var.syslog_host: X.X.X.X

    # The port to listen for syslog traffic. Defaults to 9004.
    var.syslog_port: Y.Y.Y.Y

```

It works, i recieve the logs from around 15 devices. But today i noticed that my /var/log/message -file is exploding since the activation of the Fortinet-Module.

I get the following error:

```
{"type":"mapper_parsing_exception","reason":"failed to parse field [fortinet.firewall.assignip] of type [ip] in document with id '5l6cVnMBP7KwE6GF3kEA'. Preview of field's value: 'N/A'","caused_by":{"type":"illegal_argument_exception","reason":"'N/A' is not an IP string literal."}}
Jul 16 09:53:07 datanode02 filebeat: 2020-07-16T09:53:07.078+0200#011INFO#011[publisher]#011pipeline/retry.go:221#011retryer: send unwait signal to consumer
Jul 16 09:53:07 datanode02 filebeat: 2020-07-16T09:53:07.078+0200#011INFO#011[publisher]#011pipeline/retry.go:225#011 done

```

Any ideas how to get rid of it? I just cannot keep an eye this log file forever.

Kind regards,  
Moritz

---

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [July 16, 2020, 8:44am UTC](https://discuss.elastic.co/t/parsing-error-in-fortinet-module-pipeline-blasts-up-message-log/241411/2 "2020-07-16T08:44:10Z")

</div>

I checked the Ingest Pipeline and found the following :

```
 {
    "remove": {
      "if": "ctx.fortinet?.firewall?.assignip == 'N/A'",
      "field": "fortinet.firewall.assignip"
    }  

```

So actually these events should not occur since the field actually should be removed beforehand.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 10:44am UTC](https://discuss.elastic.co/t/parsing-error-in-fortinet-module-pipeline-blasts-up-message-log/241411/3 "2020-08-13T10:44:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.