# Ship FortiGate logs to ELK 6.8.6 with TLS enabled
**URL:** https://discuss.elastic.co/t/ship-fortigate-logs-to-elk-6-8-6-with-tls-enabled/217430
**Category:** Logstash
**Created:** [January 31, 2020, 4:56pm UTC](https://discuss.elastic.co/t/ship-fortigate-logs-to-elk-6-8-6-with-tls-enabled/217430 "2020-01-31T16:56:55Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@claud81](https://discuss.elastic.co/u/claud81)
#### Post date: [January 31, 2020, 4:56pm UTC](https://discuss.elastic.co/t/ship-fortigate-logs-to-elk-6-8-6-with-tls-enabled/217430/1 "2020-01-31T16:56:56Z")
Hi,
I'm trying to ship FortiGate 6.0 logs to ELK 6.8.6.
With **udp input plugin** all works fine on another ELK 6.8.6 stack without TLS, I can't see all the logs into Kibana.
If I try to enable the **tcp input plugin** with certificate and TLS on ELK 6.8.6 I can't see any FortiGate logs into Kibana.
Anyway, syslog logs of linux server are working fine with TLS on ELK stack.
No relevant errors into logs except for something related to timestamp mapping for ES.
Here are my FortiGate config:
> status : enable
> server : 192.168.XXX.XXX
> mode : reliable
> port : 5044
> facility : local7
> source-ip :
> format : default
> enc-algorithm : high-medium
> ssl-min-proto-version: default
> certificate : elastic-stack-ca
My logstash conf file:
> input {
> tcp {
> port =\> 5044
> type =\> firewall
> ssl\_enable =\> true
> ssl\_key =\> '/etc/logstash/logstash.key'
> ssl\_cert =\> '/etc/logstash/logstash.crt'
> ssl\_certificate\_authorities =\> '/etc/logstash/elastic-ca.pem'
> ssl\_verify =\> false
> }
> }
> filter {
> if [type] == "firewall" {
> mutate {
> add\_tag =\> ["fortigate"]
> }
> grok {
> break\_on\_match =\> false
> match =\> ["message", "%{SYSLOG5424PRI:syslog\_index}%{GREEDYDATA:message}"]
> overwrite =\> ["message"]
> tag\_on\_failure =\> ["failure\_grok\_fortigate"]
> }
> kv { }
> if [msg] {
> mutate {
> replace =\> ["message", "%{msg}"]
> }
> }
> mutate {
> convert =\> { "duration" =\> "integer" }
> convert =\> { "rcvdbyte" =\> "integer" }
> convert =\> { "rcvdpkt" =\> "integer" }
> convert =\> { "sentbyte" =\> "integer" }
> convert =\> { "sentpkt" =\> "integer" }
> convert =\> { "cpu" =\> "integer" }
> convert =\> { "disk" =\> "integer" }
> convert =\> { "disklograte" =\> "integer" }
> convert =\> { "fazlograte" =\> "integer" }
> convert =\> { "mem" =\> "integer" }
> convert =\> { "totalsession" =\> "integer" }
> }
> mutate {
> add\_field =\> ["logTimestamp", "%{date} %{time}"]
> add\_field =\> ["loglevel", "%{level}"]
> replace =\> ["fortigate\_type", "%{type}"]
> replace =\> ["fortigate\_subtype", "%{subtype}"]
> remove\_field =\> ["msg", "level", "date", "time"]
> }
> date {
> locale =\> "en"
> match =\> ["logTimestamp", "YYYY-MM-dd HH:mm:ss"]
> remove\_field =\> ["logTimestamp", "year", "month", "day", "time", "date"]
> #add\_field =\> ["type", "syslog"]
> }
> if [status] == "clash" {
> grok {
> match =\> { "new\_status" =\> "state=%{GREEDYDATA:new\_status\_state1} tuple-num=%{GREEDYDATA:new\_status\_tuple-num1} policyid=%{GREEDYDATA:new\_status\_policyid1} identidx=%{GREEDYDATA:new\_status\_identidx1} dir=%{GREEDYDATA:new\_status\_dir1} act=%{GREEDYDATA:new\_status\_act1} hook=%{GREEDYDATA:new\_status\_hook1} dir=%{GREEDYDATA:new\_status\_dir2} act=%{GREEDYDATA:new\_status\_act2} hook=%{GREEDYDATA:new\_status\_hook2} dir=%{GREEDYDATA:new\_status\_dir3} act=%{GREEDYDATA:new\_status\_act3} hook=%{GREEDYDATA:new\_status\_hook3}" }
> }
> grok {
> match =\> { "old\_status" =\> "state=%{GREEDYDATA:old\_status\_state1} tuple-num=%{GREEDYDATA:old\_status\_tuple-num1} policyid=%{GREEDYDATA:old\_status\_policyid1} identidx=%{GREEDYDATA:old\_status\_identidx1} dir=%{GREEDYDATA:old\_status\_dir1} act=%{GREEDYDATA:old\_status\_act1} hook=%{GREEDYDATA:old\_status\_hook1} dir=%{GREEDYDATA:old\_status\_dir2} act=%{GREEDYDATA:old\_status\_act2} hook=%{GREEDYDATA:old\_status\_hook2} dir=%{GREEDYDATA:old\_status\_dir3} act=%{GREEDYDATA:old\_status\_act3} hook=%{GREEDYDATA:old\_status\_hook3}" }
> }
> }
> }
> }
> output {
> if "fortigate" in [tags] {
> elasticsearch {
> hosts =\> ["[https://logserver-dev1:9200](https://logserver-dev1:9200)", "[https://logserver-dev2:9200](https://logserver-dev2:9200)" ]
> index =\> "fortigate-%{+YYYY.MM.dd}"
> user =\> "logstash\_internal"
> password =\> "password"
> cacert =\> '/etc/logstash/elastic-ca.pem'
> ssl\_certificate\_verification =\> false
> ssl =\> true
> }
> }
> stdout { codec =\> rubydebug }
> }
This directive:
> stdout { codec =\> rubydebug }
seems to have no effect, I can't enable debug and most of all I can't see anything into Kibana!
Any support will be appreciated 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2020, 4:57pm UTC](https://discuss.elastic.co/t/ship-fortigate-logs-to-elk-6-8-6-with-tls-enabled/217430/2 "2020-02-28T16:57:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.