Filebeat integration

[fredtj]

Hello,

Is it possible to skip Logstash and use the new Filebeat Fortinet module?

Regards

[enotspe]

Kv will work. You will need to work on timestamp and field translation though

[fredtj]

Just had a further look at this and the problem I'm having is that all my logs are sent to the same port from Fortianalyzer, the Fortinet module in Beats is accepting the different logs on the same port. The logstash pipeline here expects the different types of logs on different ports. I guess I just need to adjust that to get things to work.

[enotspe]

you can create multiple syslog forwarders on faz, each one of them sending to different ports

[fredtj]

just had a look and not noticed that before, thanks!