FortiGate logs forwarded from FortiAnalyzer not extracting timestamp

[ejwade]

After upgrading FortiAnalyzer (FAZ) to 6.2.3, I'm seeing Splunk timestamping issues from the FortiGate (FGT) logs it forwards to Splunk. To reiterate, FGT logs are sent to FAZ, then FAZ forwards those logs (via syslog) to Splunk. According to the FortiGate TA, this is supported, and it had worked before upgrading FAZ.

What I'm seeing is all logs writing to a specific timestamp (in my case, 7:00 AM). Splunk does not seem to be extracting the timestamp field correctly. The TA's settings for timestamps are pretty basic:

[fgt_traffic]
TIME_PREFIX = ^

Everything else is default.

Here is a sample event, that is getting written to 7:00 AM:

<189>logver=506051600 timestamp=1598992014 tz="UTC-7:00" devname="<redacted>" devid="<redacted>" vd="<redacted>" date=2020-09-01 time=13:26:55 logid="0000000013" type="traffic" subtype="forward" level="notice" eventtime=1598992015 srcip=<redacted> srcport=<redacted> srcintf="<redacted>" srcintfrole="wan" dstip=<redacted> dstport=<redacted> dstintf="<redacted>" dstintfrole="lan" poluuid="<redacted>" sessionid=2089596897 proto=6 action="timeout" policyid=1 policytype="policy" service="<redacted>" dstcountry="United States" srccountry="Netherlands" trandisp="noop" duration=10 sentbyte=40 rcvdbyte=0 sentpkt=1 rcvdpkt=0 appcat="unscanned" crscore=5 craction=262144 crlevel="low"

I tried changing the TIME_PREFIX to "timestamp=" and the TIME_FORMAT to "%s". No luck. Any ideas?

[ejwade · Accepted solution]

I figured out a solution to this issue. I set the following in props.conf:

[fgt_log]
TIME_FORMAT = %s
TIME_PREFIX = timestamp=

I had to enable/disable the log forwarding flow in FortiAnalyzer to figure out which change was the right one. I was able to determine that adding a TIME_FORMAT and TIME_PREFIX to the initial source type, "fgt_log," was the change that stuck.