FortiGate UTM subtypes (webfilter, app-ctrl) not indexed — only traffic type is parsed #2762
Unanswered
secureline-tr
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
UTMStack v11.2.13-community appears to only parse and index syslog messages in type="traffic" format for the FortiGate integration (firewall-fortigate-traffic, port 7005).
Subtypes under type="utm" (subtype="webfilter", subtype="app-ctrl", etc.) are reaching the UTMStack agent from FortiGate on the same port 7005 - we confirmed this with tcpdump, the messages are genuinely arriving. However, these messages never appear or get indexed in Log Explorer (log-firewall-fortigate-traffic-* index).
In log-collector-config.json, only a single integration named "firewall-fortigate-traffic" is defined; we could not find a separate "utm"/"webfilter" integration.
Our questions:
We will attach a sample raw syslog message (with IP/hostname information masked) to this discussion.
log.txt
All reactions