Hello, I try to configure pipeline that it adds timezone to FortiGate logs which looks like below: date=2019-05-15 time=10:56:59 devname=“…” devid=“…” logid=“…” type=“traffic” subtype=“local” level=“notice” vd=“root” eventtime=1557910619 srcip=… srcname=“…” srcport=137 srcintf=“lan” srcintfrole=…

I don’t know if you solved your problem or not - but my Stage 0 for Fortinet devices (almost all have the weird timestamp): rule "fortigate timestamp" when (has_field("devname") && has_field("date") && has_field("time")) or (has_field("device_id") && contains(to_string($message.device_id), …

Adding timezone to FortiGate logs

Graylog Central (peer support)

jan (Jan Doberstein) May 22, 2019, 6:00am 10

how does your field date and time look like?

Topic		Replies	Views
Fortinet, syslog timestamp timezone set wrong Graylog Central (peer support)	6	4984	January 17, 2018
How to correct syslog input that is missing timezone data? Graylog Central (peer support) pipeline-rules	3	1698	June 21, 2020
Fortinet / Fortigate syslog time Graylog Central (peer support)	3	4349	July 7, 2021
FortiGate and timezone settings Graylog Central (peer support)	2	1330	March 24, 2021
I get a log For Device system Alerts received message but No results on search page Help Me Graylog Central (peer support) pipeline-rules	7	1391	July 27, 2020

Adding timezone to FortiGate logs

Related topics