tep 1 - Install Filebeat

To get started first follow the steps below:

 Install filebeat
 Root access
 Verify the required port is open
Older versions can be found here filebeat 7, filebeat 6, filebeat 5
Step 2 - Configure Fortigate Logging

Configure the Fortigate firewall to log to a syslog server:

You can configure the Fortigate firewall to log to a syslog server through the web interface or
through the CLI. To configure through the web interface, go to "System" -> "Log & Report" ->
"Syslog".

From there, you can add a new syslog server and specify the IP address or hostname of the
machine running Filebeat.

 Log format: syslog

 Send over: UDP
 IP Address: Your Filebeat server IP address
 Port: 514
To configure through the CLI, run the following commands:
Copyconfig log syslogd setting
set status enable
set format default
set server <Filebeat_machine_IP_Address>
set port 514
end
Step 3 - Configure Filebeat.Yml

The configuration file below is pre-configured to send data to your Logit.io Stack.

Copy the configuration file below and overwrite the contents of the Filebeat configuration file
typically located at /etc/filebeat/filebeat.yml
Copy# ============================== Filebeat inputs ========================
=======
filebeat.inputs:

- type: udp
max_message_size: 10MiB
 host: "0.0.0.0:514"
enabled: true

fields:
type: fortigate
fields_under_root: true
encoding: utf-8
ignore_older: 12h

# ================================== Outputs ================================

===
output.logstash:
hosts: ["your-logstash-host:your-ssl-port"]
loadbalance: true
ssl.enabled: true
If you’re running Filebeat 7, add this code block to the end. Otherwise, you can leave it out.
Copy# ... For Filebeat 7 only ...
filebeat.registry.path: /var/lib/filebeat
If you’re running Filebeat 6, add this code block to the end.
Copy# ... For Filebeat 6 only ...
registry_file: /var/lib/filebeat/registry
It’s a good idea to run the configuration file through a YAML validator to rule out indentation
errors, clean up extra characters, and check if your YAML file is valid. Yamllint.com is a great
choice.
Step 4 - Validate Configuration

Step 5 - Start Filebeat

Start or restart filebeat to apply the configuration changes.

Step 6 - Launch Logit.Io To View Your Logs

Now you should view your data:

VIEW MY DATA
If you don't see logs take a look at How to diagnose no data in Stack below for how to diagnose
common issues.
Step 7 - How To Diagnose No Data In Stack

If you don't see data appearing in your Stack after following the steps, visit the Help Centre
guide for steps to diagnose no data appearing in your Stack or Chat to support now.
 Step 8 - Fortigate Overview

FortiGate firewalls provide advanced network security features for enterprise environments,
protecting against cyber threats and unauthorized access. To effectively monitor and analyze
network activity, it is essential to have a reliable and efficient log management solution. Filebeat,
a popular open-source shipping tool, is widely used to send logs from FortiGate firewalls to
various destinations, including Elasticsearch, Logstash, and Kibana, due to its reliability and
minimal memory footprint.

Filebeat, which is written in Go, combines key features from Logstash-Forwarder and
Lumberjack to generate, parse, tail, and forward common logs within the logging pipeline to be
indexed within Elasticsearch. Filebeat is the most popular way to send logs to ELK, out of the
entire collection of open-source shipping tools, including Auditbeat, Metricbeat, and Heartbeat.
Earlier versions of Filebeat only allowed users to send events to Logstash and Elasticsearch, but
recent updates to the shipper have made it compatible with Redis & Kafka.
Sending logs from FortiGate firewalls to Filebeat is a simple process that involves configuring
the firewall to forward logs to a syslog server. Once the logs are received by the syslog server,
Filebeat can be used to collect and forward log data to Elasticsearch or other destinations.

Filebeat provides a filebeat.yml wizard that helps users avoid complex logging concerns, such as
large registry files and frequent errors encountered when handling deleted or renamed log files.
Users can also consider our Hosted ELK service to simplify tracking numerous pipelines using
this shipper.

In summary, Filebeat is an essential tool for efficiently managing log data from FortiGate
firewalls. Its reliability, minimal memory footprint, and compatibility with various destinations
make it a popular choice for many organizations. To ensure effective log management and
analysis, users should consider configuring FortiGate firewalls to forward logs to Filebeat and
taking advantage of the shipper's advanced features.

If you need any further assistance with migrating your log data to ELK we're here to help you get
started. Feel free to get in contact with our support team by sending us a message via live chat &
we'll be happy to assist.
RETURN TO SEARCH

SIGN UP

 PLATFORM
o Logging
o Metrics
o Observability
o Features
o Pricing

 SOLUTIONS

o Monitoring
o Security Log
o Application Logging
o Logging Made Easy
o Django Logging
o Compliance and Auditing
o Analysis
o CMMC Solution
o Azure Logging
o Log Viewer