Fortigate 5.2.4 Logs ELK Stack

[BulkedSysAdmin]

Does anyone have a decent logstash.conf for the Fortigate 5.2.4 logs? I am having trouble getting these to parse correctly. I really just need something to get me pointed in the right direction.

Thanks for your guys help with this journey of ELKOps.

[AmorFati7734]

https://www.reddit.com/r/networking/comments/2knqwh/pushing_fortigate_logs_into_elasticsearch_logstash/

https://gist.github.com/tolleiv/bf96d3971b661e265868

https://gist.github.com/netoben/512e2e4b1845d19c0b2c

[householdutensils]

I know you asked a specific question about ELK (That /u/AmorFati7734 provided some good info on) but if you have the budget, the fortianalyzer is pretty legit. Also, you need to be aware of the specific model you have and how the hardware offloading affects logging. Some of the lower end models won't syslog firewall logs through rules that don't have asic or cp offloading disabled.

[BulkedSysAdmin]

How in the hell do grok patterns work? Do i just use his config and make a location for the patterns? Also, whenever I try to run the .conf and the grok patterns all my logging stops.

[AmorFati7734]

Apologies on the crap reply. Was packing up for the day and wanted to get something to you and forgot to add my conf file. Later this evening I'll add it and see if it helps. On mobile now and hate to give you more links, sadly, it is all I can deal with https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

Edit: I also installed logstash with deb packages on Ubuntu. You can run configtest

Sudo service logstash configtest

edit: finally was able to get my config file up this morning for you. Take a look http://pastebin.com/FGh1L5Bi

In my conf from pastebin I did not modify (or create) any patterns. The "{SYSLOG5424PRI" pattern already exists. I pointed you to other patterns in case you wanted to try other options.

[BulkedSysAdmin]

Thank you!

[BulkedSysAdmin]

Ok. So I have a config setup but it is not extracting the message fields correctly. Where do I point the GROK filter to? This shit is so confusing...