Logstash log parsing sample for FortiOS after 5.6

fortigate.pattern

FORTIDATE %{YEAR:year}\-%{MONTHNUM:month}\-%{MONTHDAY:day}

logstash.conf

input {
  tcp {
    port => 514
    tags => "syslog"
  }
  udp {
    port => 514
    tags => "syslog"
  }
  stdin {}
}

filter {
  if "syslog" in [tags] {
    grok {
      patterns_dir => [ "/etc/logstash/patterns.d" ]
      match => {
        "message" => [ "%{SYSLOG5424PRI:syslog_index}date=%{FORTIDATE:date} time=%{TIME:time} devname=\"%{HOSTNAME:devname}\" devid=\"%{HOSTNAME:devid}\" logid=\"%{NUMBER:logid}\" type=\"%{DATA:type}\" subtype=\"%{DATA:subtype}\" %{GREEDYDATA:fortigate}" ]
      }
      add_tag => [ "FortiGate" ]
    }
    if "FortiGate" in [tags] {
      mutate {
        add_field => { "FORTIDATETIME" => "%{date} %{time}" }
      }
      date {
        match => [ "FORTIDATETIME", "YYYY-MM-dd HH:mm:ss" ]
        timezone => "Asia/Tokyo"
        locale => en
        target => "@timestamp"
      }
      kv {
        source => "fortigate"
        field_split => "\s"
        value_split => "="
      }
      mutate {
        remove_field => [ "syslog_index", "year", "month", "day", "fortigate", "date", "time", "FORTIDATETIME", "message" ]
      }
      if "event" in [type] {
        mutate {
          add_tag => [ "Event" ]
        }
      }
      if "traffic" in [type] {
        mutate {
          add_tag => [ "Traffic" ]
        }
      }
      if "utm" in [type] {
        mutate {
          add_tag => [ "UTM" ]
        }
      }
      if "dns" in [type] {
        mutate {
          add_tag => [ "DNS" ]
        }
      }
      if "anomaly" in [type] {
        mutate {
          add_tag => [ "Anomaly" ]
        }
      }
      if "Traffic" in [tags] or "UTM" in [tags] or "Anomaly" in [tags] {
        if [srcip] !~ "(^127\.)|(^169\.254\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)" {
          geoip {
            source => "srcip"
            target => "src_geoip"
          }
        }
        if [dstip] !~ "(^127\.)|(^169\.254\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)" {
          geoip {
            source => "dstip"
            target => "dst_geoip"
          }
        }
      }
    }
  }
}

output {
  if "FortiGate" in [tags] {
    if "Event" in [tags] {
      elasticsearch {
        hosts => [ "127.0.0.1:9200" ]
        index => "fortigate_event-%{+YYYY.MM.dd}.log"
      }
    }
    if "Traffic" in [tags] {
      elasticsearch {
        hosts => [ "127.0.0.1:9200" ]
        index => "fortigate_traffic-%{+YYYY.MM.dd}.log"
      }
    }
    if "UTM" in [tags] {
      elasticsearch {
        hosts => [ "127.0.0.1:9200" ]
        index => "fortigate_utm-%{+YYYY.MM.dd}.log"
      }
    }
    if "DNS" in [tags] {
      elasticsearch {
        hosts => [ "127.0.0.1:9200" ]
        index => "fortigate_dns-%{+YYYY.MM.dd}.log"
      }
    }
    if "Anomaly" in [tags] {
      elasticsearch {
        hosts => [ "127.0.0.1:9200" ]
        index => "fortigate_anomaly-%{+YYYY.MM.dd}.log"
      }
    }
  }
#  stdout { codec => rubydebug }
}