Skip to content

NimTechnology

Trình bày các công nghệ CLOUD một cách dễ hiểu.

  • Kubernetes & Container
    • Docker
    • Kubernetes
      • Ingress
    • Helm Chart
    • Isito-EnvoyFilter
    • Apache Kafka
      • Kafka
      • Kafka Connect
      • Lenses
    • Vault
    • Longhorn – Storage
    • VictoriaMetrics
    • MetalLB
    • Kong Gateway
  • CI/CD
    • ArgoCD
    • ArgoWorkflows
    • Spinnaker
    • Jenkins
    • Harbor
    • TeamCity
    • Git
      • Bitbucket
  • Coding
    • Terraform
      • GCP – Google Cloud
      • AWS – Amazon Web Service
    • Golang
    • Laravel
    • Python
    • Jquery & JavaScript
    • Selenium
  • Log & Monitor
    • DataDog
    • Prometheus
    • Grafana
    • ELK
      • Kibana
      • Logstash
  • BareMetal
    • NextCloud
  • Toggle search form

[Fortigate] Cấu hình firewall fortigate gửi syslog sang Logstash

Posted on August 8, 2021February 1, 2022 By nim No Comments on [Fortigate] Cấu hình firewall fortigate gửi syslog sang Logstash

Bạn vào fortigate của bạn và tìm đến chỗ tương tự như ảnh của mình.

192.168.101.30 là ip của server logstash

thường thì fortigate sẽ gửi syslog ra ngoài tới destination port là 514

Nếu các bạn muốn gõ câu lệnh để cấu hình thì tham khảo video sau:

Giờ qua cấu hình logstash để cấu hình nhận log

tham khảo link dưới đây

https://devinegrace.tistory.com/37

giờ là phần mình làm cấu hình pipelines.yaml thêm dòng này

- pipeline.id: fortigate
  path.config: "/usr/share/logstash/pipeline/fortigate.conf"

Cấu hình pipeline cho logstash

input {
  udp {
    port => 514
    tags => "FWlog"
  }
}

filter { 
  grok { 
    match => ["message", "%{SYSLOG5424PRI:syslog_index}%{GREEDYDATA:message}"] 
    overwrite => [ "message" ] 
  } 

  date { 
    match => ["timestamp" , "yyyy-MM-dd'T'HH:mm:ss.SSSZ"] 
    target => "@timestamp" 
    #add_field => { "debug" => "timestampMatched"} 
  } 

  kv { 
    source => "message" 
    exclude_keys => [ "type", "tags"] 
  } 

  geoip { source => "dst" } 
  geoip { source => "dstip" } 
  geoip { source => "src" } 
  geoip { source => "srcip" } 

  mutate { 
    rename => [ "dst", "dst_ip" ] 
    rename => [ "dstip", "dst_ip" ] 
    rename => [ "dstport", "dst_port" ] 
    rename => [ "devname", "device_id" ] 
    rename => [ "status", "action" ] 
    rename => [ "src", "src_ip" ] 
    rename => [ "srcip", "src_ip" ] 
    rename => [ "zone", "src_intf" ] 
    rename => [ "srcintf", "src_intf" ] 
    rename => [ "srcport", "src_port" ] 
    rename => [ "rcvd", "byte_recieved" ] 
    rename => [ "rcvdbyte", "bytes_recieved" ] 
    rename => [ "sentbyte", "bytes_sent" ] 
    rename => [ "sent", "bytes_sent" ] 
    rename => [ "cpu", "cpu_usage" ] 
    rename => [ "mem", "mem_usage" ] 
    rename => [ "disk", "disk_usage" ] 
    convert => ["bytes_recieved", "integer"] 
    convert => ["bytes_sent", "integer"] 
    convert => ["cpu_usage", "integer"] 
    convert => ["mem_usage", "integer"] 
    convert => ["disk_usage", "integer"] 
    convert => ["disklograte", "integer"] 
  } 
}


## Add your filters / logstash plugins configuration here

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    user => "elastic"
    password => "nim123"
    index => "fwlog-%{+YYYY.MM.dd}" 
  }
  stdout {
    codec => rubydebug
  }
}

vào dev tools trên kibana

GET _cat/indices?v

BareMetal, ELK, Logstash

Post navigation

Previous Post: [Logstash] Multi config, input, filter, output inside a Logstash server and Not conflict
Next Post: [Kibana] Sankey chart draw from point A to point B – So beautiful

More Related Articles

[Kibana-ELK] Installing and Seting a Kibana For ELK ELK
[VMware] Comand check health disk ESXi BareMetal
[Kafka] Kafka Topics CLI Apache Kafka
[OpenVPN] Why is not Android working with the DNS of the OpenVPN? BareMetal
[NFS] Hướng dẫn cài đặt share storage NFS trên centos7 BareMetal
[Smartctl] Instruction check the health disk of Raspberry. BareMetal

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Tham Gia Group DevOps nhé!
Để Nim có nhiều động lực ra nhiều bài viết.
Để nhận được những thông báo mới nhất.

Recent Posts

  • [Prometheus/Grafana] Install Prometheus and Grafana on ubuntu. March 27, 2023
  • [Kong Gateway] WebSocket connection failed March 26, 2023
  • [Nextcloud] Can’t download files to have a size bigger than 2Gi on NextCloud – RaspBerry March 24, 2023
  • [Datadog] Using DataDog to monitor all services on kubernetes March 19, 2023
  • [Metrics Server] Failed to make webhook authorizer request: the server could not find the requested resource March 17, 2023

Archives

  • March 2023
  • February 2023
  • January 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021

Categories

  • BareMetal
    • NextCloud
  • CI/CD
    • ArgoCD
    • ArgoWorkflows
    • Git
      • Bitbucket
    • Harbor
    • Jenkins
    • Spinnaker
    • TeamCity
  • Coding
    • Golang
    • Jquery & JavaScript
    • Laravel
    • Python
    • Selenium
    • Terraform
      • AWS – Amazon Web Service
      • GCP – Google Cloud
  • Kubernetes & Container
    • Apache Kafka
      • Kafka
      • Kafka Connect
      • Lenses
    • Docker
    • Helm Chart
    • Isito-EnvoyFilter
    • Kong Gateway
    • Kubernetes
      • Ingress
    • Longhorn – Storage
    • MetalLB
    • Vault
    • VictoriaMetrics
  • Log & Monitor
    • DataDog
    • ELK
      • Kibana
      • Logstash
    • Grafana
    • Prometheus
  • Uncategorized
  • Admin

Copyright © 2023 NimTechnology.