Fortigate Firewall Logstash Grok filter

gistfile1.rb

input {
        syslog {
                type => "fortigate"
                port => 5001
        }
}

filter {
  if [type] == "fortigate" {

        grok {
                match => [ "message", "<(?<ruleID>.*)>(?<msg>.*)" ]
        }

        kv { source => "msg" }

        geoip { source => "dst" }
  }
}

output {
        elasticsearch {
                embedded => false
        }
        #stdout { codec => rubydebug }
}