Fortigate Integration - Separation of logs datastream based on a field value

Knight7
Tue, 05 Aug 2025 16:48:16 +0000
Elastic Agent

Hello,

We have integrated Fortinet Fortigate Firewall logs to our SIEM ELK using the Elastic Agent integration. We created also a custom ingest pipeline that separates the logs (for example forward) and send them to a dedicated datastream.

The problem is that ingest pipeline doesnt work and the new datastream/index is not created.

How to solve that or if there any other solutions to separate these logs.

Thanks.

11 posts - 3 participants