# FortiGate: I can get CEF logs over UDP and Syslog over TLS, but not CEF over TLS. Why?

**URL:** <https://community.graylog.org/t/fortigate-i-can-get-cef-logs-over-udp-and-syslog-over-tls-but-not-cef-over-tls-why/28442>\
**Category:** Graylog Central (peer support)\
**Created:** [April 14, 2023, 11:28pm UTC](https://community.graylog.org/t/fortigate-i-can-get-cef-logs-over-udp-and-syslog-over-tls-but-not-cef-over-tls-why/28442 "2023-04-14T23:28:14Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [April 15, 2023, 12:36am UTC](https://community.graylog.org/t/fortigate-i-can-get-cef-logs-over-udp-and-syslog-over-tls-but-not-cef-over-tls-why/28442/3 "2023-04-15T00:36:58Z")

</div>

So my first guess is you are on the right track and its a format issue. Graylog will throw out messages that dont follow the format that they should (you should be able to see that in the server.log)

There is a pipeline rule posted in this thread and some instructions that should help [Fortinet CEF Formatting issues - #11 by rfinney](https://community.graylog.org/t/fortinet-cef-formatting-issues/12017/11)

---

_[View the full topic](https://community.graylog.org/t/fortigate-i-can-get-cef-logs-over-udp-and-syslog-over-tls-but-not-cef-over-tls-why/28442)._