Getting Data In

FortiAnalzer Field Extraction

Rhidian
Explorer

Hi,

I'm receiving FortiGate event via FortiAnalyser and I need to set the Host to the name of the device that created the event which is contained in the event message as devname.

May 10 10:44:30 10.90.223.5 date=2021-05-10 time=11:44:30 devname="test" devid="test" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1620643470882685981 tz="+0100" srcip= srcport=62408 srcintf="" srcintfrole="undefined" dstip= dstport=53 dstintf="port2" dstintfrole="wan" sessionid=81948384 proto=17 action="accept" policyid=23 policytype="policy" poluuid="cbd3e37e-5bf1-51eb-f2ad-0a49a47d1d1d" service="Domain Services UDP" dstcountry="Reserved" srccountry="Reserved" trandisp="noop" duration=180 sentbyte=76 rcvdbyte=194 sentpkt=1 rcvdpkt=1 vpn="" vpntype="ipsec-dynamic" appcat="unscanned"

 

I have started to build the transform below but it doesn't work.

[Set-Host-By-Devname]

REGEX = ([^.+?devname=\"[A-Z0-9]+")

FORMAT = host::$1

DEST_KEY = MetaData:Host

 

0 Karma
1 Solution

Rhidian
Explorer

Sure

[fortigate_log]
TRANSFORMS-Set-Host-By-DevName
SHOULD_LINEMERGE = false

View solution in original post

0 Karma

aasabatini
Builder

Hi @Rhidian 

Can you share also your props.conf?

 

 

 

0 Karma

Rhidian
Explorer

Sure

[fortigate_log]
TRANSFORMS-Set-Host-By-DevName
SHOULD_LINEMERGE = false

View solution in original post

0 Karma

aasabatini
Builder

Hi @Rhidian 

try your props like this

[fortigate_log]
TRANSFORMS-meta = Set-Host-By-Devname
SHOULD_LINEMERGE = false

if doesn't works we need to works on your regex

0 Karma

Rhidian
Explorer

No joy I think it is the regex...

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!