[FortiGate] elasticsearch를 이용한 로그 수집

FortiGate syslog 설정을 통해 Filebeat fortinet module을 이용하여 elasticsearch에서 로그를 수집한다.

 

 

 

FortiGate 로그 설정

참조 : https://ploz.tistory.com/entry/FortiGate-%EC%99%B8%EB%B6%80-syslog-%EC%84%9C%EB%B2%84%EB%A1%9C-%EB%A1%9C%EA%B7%B8-%EB%B3%B4%EB%82%B4%EA%B8%B0

[FortiGate] 외부 syslog 서버로 로그 보내기

 

> get log syslogd setting 
status              : enable 
server              : 10.200.20.250 
mode                : udp 
port                : 9004
facility            : local4 
source-ip           : 
format              : default 
priority            : default 
max-log-rate        : 0
interface-select-method: auto

 

 

 

Filebeat 설정

Fortinet module enable

> filebeat modules enable fortinet
Enabled fortinet

> filebeat modules list
Enabled:
fortinet
...

 

 

Fortinet module config

- module: fortinet
  firewall:
    enabled: true
    var.input: udp
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9004

 

 

Filebeat index 설정

> filebeat.yml
...
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  indices:
    - index: "filebeat-%{[agent.version]}-fortinet-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "fortinet"
...