Nagios Support Forum

Code: Select all

udp {
	port => 5514
	type => 'fortigate'
}

Code: Select all

if [type] == "fortigate" {
	mutate {
		add_tag => ["fortigate"]
	}
	grok {
	    break_on_match => false
		match => ["message", "%{SYSLOG5424PRI:syslog_index}%{GREEDYDATA:message}"]
		overwrite => [ "message" ]
		tag_on_failure => [ "failure_grok_fortigate" ]
	}
		kv { }
	if [msg] {
		mutate {
			replace => [ "message", "%{msg}" ]
		}
	}
	mutate {
		convert => { "duration" => "integer" }
		convert => { "rcvdbyte" => "integer" }
		convert => { "rcvdpkt" => "integer" }
		convert => { "sentbyte" => "integer" }
		convert => { "sentpkt" => "integer" }
		convert => { "cpu" => "integer" }
		convert => { "disk" => "integer" }
		convert => { "disklograte" => "integer" }
		convert => { "fazlograte" => "integer" }
		convert => { "mem" => "integer" }
		convert => { "totalsession" => "integer" }
	}
	mutate {
		add_field => ["logTimestamp", "%{date} %{time}"]
		add_field => ["loglevel", "%{level}"]
		replace => [ "fortigate_type", "%{type}"]
		replace => [ "fortigate_subtype", "%{subtype}"]
		remove_field => [ "msg", "type", "level", "date", "time" ]
	}
	date {
		locale => "en"
		match => ["logTimestamp", "YYYY-MM-dd HH:mm:ss"]
		remove_field => ["logTimestamp", "year", "month", "day", "time", "date"]
		add_field => ["type", "syslog"]
	}
}