elastic / elastic/integrations

[Fortinet Fortigate]: Space added to host.name field sometimes.

Open
#14,473 2 comments 0 reactions 0 assignees View on GitHub
Integration:fortinet_fortigate Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Fortinet FortiGate Firewall Logs [fortinet_fortigate]

### Dataset Name

fortinet_fortigate.log

### Integration Version

1.33.0

### Agent Version

8.17.7

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.7

### OS Version and Architecture

Cloud Deployment

### Software/API Version

_No response_

### Error Message

No explicit error but here is a description:
The host.name field is being parsed inconsistently: some log entries include a trailing space (“laptop-01 ”), while others omit it (“laptop-01”). As a result, dashboards and alerts split the same host into two entities, and event counts appear fragmented.

### Event Original

_No response_

### What did you do?

No special configuration

### What did you see?

A subset of events is indexed under host.name = "laptop-01 " (note the trailing space).
The remaining events for the same machine are indexed under host.name = "laptop-01" (no trailing space).
Combined, both buckets account for all expected events, indicating that only the trailing space differs.

### What did you expect to see?

All events from the same host should be parsed into a single, consistent host.name value (e.g., "laptop-01"), with no trailing whitespace.

### Anything else?

The host.name field is being parsed inconsistently: some log entries include a trailing space (“laptop-01 ”), while others omit it (“laptop-01”). As a result, dashboards and alerts split the same host into two entities, and event counts appear fragmented.

These are the daily logs for the laptop with a space in the host.name:
Image

These are the daily logs for the laptop without a space in the host.name:
Image

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.