# Problem displaying Fortigate log messages
**URL:** https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707
**Category:** Graylog Add-ons
**Tags:** pipeline-rules
**Created:** [August 7, 2020, 7:42am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707 "2020-08-07T07:42:29Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@abelcb98](https://community.graylog.org/u/abelcb98)
#### Post date: [August 7, 2020, 7:42am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/1 "2020-08-07T07:42:29Z")
Hi everyone,
Recently I have installed this content pack ([https://github.com/pfitchie/graylog3.Fortigate6xContentPack](https://github.com/pfitchie/graylog3.Fortigate6xContentPack)) on my Graylog Server to capture the Fortigate logs. I use a Graylog OVA which version is 3.3.3. So my problem is this: the messages are arriving to my Graylog server but i cannot visualize it. Of course i am redirecting the messages from port 514 to 1025 with an Iptables rule.
Best regards.
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 7, 2020, 9:29am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/2 "2020-08-07T09:29:49Z")
And what is your problem? You don’t see parsed fields or dashboard?
1. Content pack contains extractors, so check if there are in Manage exctractor button in Input FortiGate
2. Content pack contains parameters for input and stream. Did you setup correct fghostname parameter so it contains your real fortigage hostname e.g. FG123456789?
3. I do not recomment forward logs from 514, it’s better to use higher number than 1024 for input and directly send to this port from fortigate.
4. Content pack contains dashboard, but it will not probably work, because content pack was created for 3.1 version, and 3.2/3.3 hase different dashboard functionality.
---
### Author:  [@abelcb98](https://community.graylog.org/u/abelcb98)
#### Post date: [August 7, 2020, 10:34am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/3 "2020-08-07T10:34:32Z")
OK! i check and configure all you say me but i cannot see anything on the section _Show received messages_ However now i can see some statistics on Dashboard section
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 7, 2020, 10:47am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/4 "2020-08-07T10:47:32Z")
1. Maybe you have problem with timestamps, try to select all messages in timeframe selector, or use absolute time selector and check also future messages.
2. If you use admin user to login to graylog, specify correct timezone in parameter root\_timezone in `/etc/graylog/server/server.conf` file, for example:
root\_timezone = Europe/Bratislava
[https://docs.graylog.org/en/3.3/pages/configuration/server.conf.html#general](https://docs.graylog.org/en/3.3/pages/configuration/server.conf.html#general)
- Login as user ubuntu or root to linux console:
- Edit file server.conf using your favourite editor:
- if you’ve logged in as `ubuntu` user, you probably must use sudo
- `sudo vim /etc/graylog/server/server.conf`
- if you’ve logged in as root user use command:
- `vim /etc/graylog/server/server.conf`
- Find parameter root\_timezone and change `Europe/Bratislava` to your real timezone:
- `root_timezone = Europe/Bratislava`
- Save file with: press Esc, type :wq and press Enter
- Restart graylog service with:
- `sudo systemctl restart graylog.service`
- Done
1. Also change real timezone in Ubuntu linux OVA using this command:
- sudo timedatectl set-timezone Europe/Bratislava
- reboot OVA
1. Don’t forget to synchronize time using NTP on graylog and also fortigate.
---
### Author:  [@abelcb98](https://community.graylog.org/u/abelcb98)
#### Post date: [August 10, 2020, 8:04am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/5 "2020-08-10T08:04:26Z")
Thank you for your help! I found another error in /var/log/graylog-server/server.log.
What should i do? should i change the level extractor?
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 10, 2020, 8:31am UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/6 "2020-08-10T08:31:55Z")
It’s normal problem, if first message which contains level setup as numeric (which uses elestic search for ), and another message want to insert another type (string) to elastic.
You can either:
1. Create custom index mapping to type string, so field level will be string and not numeric
[https://docs.graylog.org/en/3.3/pages/configuration/elasticsearch.html#custom-index-mappings](https://docs.graylog.org/en/3.3/pages/configuration/elasticsearch.html#custom-index-mappings)
2. Rename field level before store for example pipeline rule
3. Create own index for fortigate, and don’t send another type of messages
---
### Author:  [@abelcb98](https://community.graylog.org/u/abelcb98)
#### Post date: [August 10, 2020, 12:02pm UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/7 "2020-08-10T12:02:47Z")
My problem has been resolve! i have removed the input created by the content pack and then i have created my own. All this after sync the timestamps. Thank you so much.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [August 24, 2020, 12:02pm UTC](https://community.graylog.org/t/problem-displaying-fortigate-log-messages/16707/8 "2020-08-24T12:02:53Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.