checking installation about fortinet-2-elasticsearch HOT 8 CLOSED

also i try to see what in dasboards while edit and it shows actual data
but when exit edit mode the panels is blank

from fortinet-2-elasticsearch.

I resolve it by disable filters at top))

from fortinet-2-elasticsearch.

the problematic fields are srcintfrole and dstintfrole, which has to be configured on firewall. I suggest you only disable those ones

from fortinet-2-elasticsearch.

Thanks, I forget to add it in result json they were with prefix fortigate.
did you try to port your logstash config 40-ecs-frotigate to syslog-ng config?
there are many conditions syntax by type . syslog-ng use another syntax and don't support conditions

from fortinet-2-elasticsearch.

There are no plans for using syslog-ng. Our plans are to split indices by type and sum up everythingh on datastreams.

Something like:

logs-fortinet.fortigate.traffic-space-000001
logs-fortinet.fortigate.utm-space-000001
logs-fortinet.fortigate.event-space-000001

from fortinet-2-elasticsearch.

and you plan to modify dashboards?

from fortinet-2-elasticsearch.

yes, of course!

from fortinet-2-elasticsearch.

Readme has been updated with detailed instructions. Dashboards have been updated

from fortinet-2-elasticsearch.