SC4S postfilter not dropping Fortigate east-west traffic (syslog-ng rewrite/appmodel errors)

[loganallen]

I am trying to implement a postfilter in Splunk Connect for Syslog to drop east-west (internal-to-internal) Fortigate traffic before it reaches Splunk, specifically Fortinet FortiOS traffic logs where both srcip and dstip fall within ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

My current configuration uses a sc4s-postfilter application with a filter matching on sc4s_vendor=fortinet, sc4s_product=fortios, and the traffic fields, and then attempts to drop events using rewrite(r_set_dest_splunk_null_queue) inside a block parser that is invoked by the application.

However, I am running into two problems: when using the rewrite inside a block parser I get syslog-ng appmodel parsing errors such as “unexpected KW_REWRITE”, causing the container to crash or restart, and when I adjust the syntax so that SC4S starts cleanly, the filter appears to run but no events are actually dropped and the Fortigate traffic still shows up in Splunk unchanged.

I have confirmed that SC4S is running in Docker, syslog-ng configuration passes validation, Fortigate logs are being parsed correctly with srcip/dstip present, and ingestion into Splunk via HEC is working normally, so the issue appears to be specifically with how the postfilter is structured or executed.

I am unsure whether r_set_dest_splunk_null_queue is still the correct method for dropping events, whether block parser + channel is still valid in modern SC4S versions, or how to properly verify that a postfilter is actually being executed, so I am looking for guidance or a working example of how to correctly implement east-west traffic suppression in SC4S.

block parser fortigate_drop_eastwest-postfilter() {
    channel {
        rewrite(r_set_dest_splunk_null_queue);
    };
};

application fortigate_drop_eastwest-postfilter[sc4s-postfilter] {

    filter {

        "${fields.sc4s_vendor}" == "fortinet"
        and "${fields.sc4s_product}" == "fortios"
        and "${fields.type}" == "traffic"
        and "${fields.subtype}" == "forward"
        and "${fields.action}" == "allow"

        and (
            match("^10\\.", value("fields.srcip"))
            or match("^192\\.168\\.", value("fields.srcip"))
            or match("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.", value("fields.srcip"))
        )

        and (
            match("^10\\.", value("fields.dstip"))
            or match("^192\\.168\\.", value("fields.dstip"))
            or match("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.", value("fields.dstip"))
        );
    };

    parser {
        fortigate_drop_eastwest-postfilter();
    };
};