[Fortigate] Cấu hình firewall fortigate gửi syslog sang Logstash

- pipeline.id: fortigate
  path.config: "/usr/share/logstash/pipeline/fortigate.conf"

input {
  udp {
    port => 514
    tags => "FWlog"
  }
}

filter { 
  grok { 
    match => ["message", "%{SYSLOG5424PRI:syslog_index}%{GREEDYDATA:message}"] 
    overwrite => [ "message" ] 
  } 

  date { 
    match => ["timestamp" , "yyyy-MM-dd'T'HH:mm:ss.SSSZ"] 
    target => "@timestamp" 
    #add_field => { "debug" => "timestampMatched"} 
  } 

  kv { 
    source => "message" 
    exclude_keys => [ "type", "tags"] 
  } 

  geoip { source => "dst" } 
  geoip { source => "dstip" } 
  geoip { source => "src" } 
  geoip { source => "srcip" } 

  mutate { 
    rename => [ "dst", "dst_ip" ] 
    rename => [ "dstip", "dst_ip" ] 
    rename => [ "dstport", "dst_port" ] 
    rename => [ "devname", "device_id" ] 
    rename => [ "status", "action" ] 
    rename => [ "src", "src_ip" ] 
    rename => [ "srcip", "src_ip" ] 
    rename => [ "zone", "src_intf" ] 
    rename => [ "srcintf", "src_intf" ] 
    rename => [ "srcport", "src_port" ] 
    rename => [ "rcvd", "byte_recieved" ] 
    rename => [ "rcvdbyte", "bytes_recieved" ] 
    rename => [ "sentbyte", "bytes_sent" ] 
    rename => [ "sent", "bytes_sent" ] 
    rename => [ "cpu", "cpu_usage" ] 
    rename => [ "mem", "mem_usage" ] 
    rename => [ "disk", "disk_usage" ] 
    convert => ["bytes_recieved", "integer"] 
    convert => ["bytes_sent", "integer"] 
    convert => ["cpu_usage", "integer"] 
    convert => ["mem_usage", "integer"] 
    convert => ["disk_usage", "integer"] 
    convert => ["disklograte", "integer"] 
  } 
}


## Add your filters / logstash plugins configuration here

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    user => "elastic"
    password => "nim123"
    index => "fwlog-%{+YYYY.MM.dd}" 
  }
  stdout {
    codec => rubydebug
  }
}