Skip to content

Commit d9766b7

Browse files
vinit-chauhanvinit-chauhan
authored
[fortinet_fortigate] add option to add timezone for events (#15822)
* add option to add timezone for events * add PR link to changelog
1 parent cbe3223 commit d9766b7

File tree

7 files changed

+111
-1
lines changed

7 files changed

+111
-1
lines changed

‎packages/fortinet_fortigate/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.35.0"
3+
changes:
4+
- description: Add timezone mapping for Fortinet FortiGate logs.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15822
27
- version: "1.34.1"
38
changes:
49
- description: Generate processor tags and normalize error handler.

‎packages/fortinet_fortigate/data_stream/log/agent/stream/log.yml.hbs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,14 @@ processors:
5959
- {{network}}
6060
{{/each}}
6161
{{/if}}
62+
63+
fields_under_root: true
64+
fields:
65+
_conf:
66+
{{#if tz_offset}}
67+
tz_offset: "{{tz_offset}}"
68+
{{/if}}
69+
{{#if tz_map}}
70+
tz_map:
71+
{{tz_map}}
72+
{{/if}}

‎packages/fortinet_fortigate/data_stream/log/agent/stream/tcp.yml.hbs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,14 @@ processors:
6060
{{#if tcp_options}}
6161
{{tcp_options}}
6262
{{/if}}
63+
64+
fields_under_root: true
65+
fields:
66+
_conf:
67+
{{#if tz_offset}}
68+
tz_offset: "{{tz_offset}}"
69+
{{/if}}
70+
{{#if tz_map}}
71+
tz_map:
72+
{{tz_map}}
73+
{{/if}}

‎packages/fortinet_fortigate/data_stream/log/agent/stream/udp.yml.hbs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,14 @@ processors:
5757
- {{network}}
5858
{{/each}}
5959
{{/if}}
60+
61+
fields_under_root: true
62+
fields:
63+
_conf:
64+
{{#if tz_offset}}
65+
tz_offset: "{{tz_offset}}"
66+
{{/if}}
67+
{{#if tz_map}}
68+
tz_map:
69+
{{tz_map}}
70+
{{/if}}

‎packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,26 @@ processors:
151151
replacement: $1$2
152152
ignore_missing: true
153153
ignore_failure: true
154+
155+
- set:
156+
field: event.timezone
157+
copy_from: _conf.tz_offset
158+
if: ctx.event?.timezone == null && ctx._conf?.tz_offset != null && ctx._conf.tz_offset != 'local'
159+
ignore_empty_value: true
160+
161+
- script:
162+
lang: painless
163+
tag: script_tz_mapping
164+
if: ctx.event?.timezone == null && ctx._conf?.tz_map != null &&ctx.fortinet?.firewall?.timezone != null && ctx.fortinet?.firewall?.timezone != ''
165+
source: |
166+
def tz = ctx.fortinet?.firewall?.timezone;
167+
for (def item : ctx._conf.tz_map) {
168+
if (item.tz_match_value == tz) {
169+
ctx.event.timezone = item.tz_replace_value;
170+
break;
171+
}
172+
}
173+
154174
- set:
155175
tag: set__temp_time_2240d59c
156176
field: _temp.time
@@ -777,6 +797,7 @@ processors:
777797
tag: remove_c87f67c3
778798
field:
779799
- _temp
800+
- _conf
780801
- fortinet.firewall.tz
781802
- fortinet.firewall.date
782803
- fortinet.firewall.devid

‎packages/fortinet_fortigate/data_stream/log/manifest.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,23 @@ streams:
107107
#max_message_size: 50KiB
108108
#max_connections: 1
109109
description: Specify custom configuration options for the TCP input.
110+
- name: tz_offset
111+
type: text
112+
title: Timezone
113+
multi: false
114+
required: false
115+
show_user: false
116+
description: IANA timezone or timezone offset (e.g. `+0200`) to use when interpreting syslog timestamps without a timezone.
117+
- name: tz_map
118+
type: yaml
119+
title: Timezone Map
120+
multi: false
121+
required: false
122+
show_user: false
123+
description: A combination of timezones as they appear in the Fortinet FortiGate logs, in combination with a proper IANA Timezone format (for example, Australia/Sydney or +10:00).
124+
default: |
125+
#- tz_match_value: (GMT+3:00)Kuwait,Riyadh
126+
# tz_replace_value: Asia/Kuwait
110127
template_path: tcp.yml.hbs
111128
title: Fortinet firewall logs (tcp)
112129
description: Collect Fortinet firewall logs using tcp input
@@ -187,6 +204,23 @@ streams:
187204
description: >
188205
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
189206
207+
- name: tz_offset
208+
type: text
209+
title: Timezone
210+
multi: false
211+
required: false
212+
show_user: false
213+
description: IANA timezone or timezone offset (e.g. `+0200`) to use when interpreting syslog timestamps without a timezone.
214+
- name: tz_map
215+
type: yaml
216+
title: Timezone Map
217+
multi: false
218+
required: false
219+
show_user: false
220+
description: A combination of timezones as they appear in the Fortinet FortiGate logs, in combination with a proper IANA Timezone format (for example, Australia/Sydney or +10:00).
221+
default: |
222+
#- tz_match_value: (GMT+3:00)Kuwait,Riyadh
223+
# tz_replace_value: Asia/Kuwait
190224
template_path: udp.yml.hbs
191225
title: Fortinet firewall logs (udp)
192226
description: Collect Fortinet firewall logs using udp input
@@ -249,6 +283,23 @@ streams:
249283
description: >
250284
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
251285
286+
- name: tz_offset
287+
type: text
288+
title: Timezone
289+
multi: false
290+
required: false
291+
show_user: false
292+
description: IANA timezone or timezone offset (e.g. `+0200`) to use when interpreting syslog timestamps without a timezone.
293+
- name: tz_map
294+
type: yaml
295+
title: Timezone Map
296+
multi: false
297+
required: false
298+
show_user: false
299+
description: A combination of timezones as they appear in the Fortinet FortiGate logs, in combination with a proper IANA Timezone format (for example, Australia/Sydney or +10:00).
300+
default: |
301+
#- tz_match_value: (GMT+3:00)Kuwait,Riyadh
302+
# tz_replace_value: Asia/Kuwait
252303
template_path: log.yml.hbs
253304
title: Fortinet FortiGate logs (log)
254305
description: Collect Fortinet FortiGate logs using log input

‎packages/fortinet_fortigate/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: fortinet_fortigate
22
title: Fortinet FortiGate Firewall Logs
3-
version: "1.34.1"
3+
version: "1.35.0"
44
description: Collect logs from Fortinet FortiGate firewalls with Elastic Agent.
55
type: integration
66
format_version: "3.0.3"

0 commit comments

Comments
 (0)