elastic / elastic/integrations

[Fortinet Fortigate]: Fortigate's standard value for invalid sessions is too long for component template field type

Open
#19,792 1 comment 0 reactions 1 assignee Claimed by @qcorporation View on GitHub
Integration:fortinet_fortigate needs:triage Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

Fortinet FortiGate Firewall Logs [packages/fortinet_fortigate]

### Dataset Name

fortinet_fortigate.log

### Integration Version

1.34.0

### Agent Version

9.3.5

### Agent Output Type

logstash

### Elasticsearch Version

9.3.5

### OS Version and Architecture

Docker

### Software/API Version

_No response_

### Error Message

Invalid Value

### Event Original

N/A, Couldn't find the logs anymore.

### What did you do?

gsubbed values longer than 20 digits with the maximum value for the configured field type.

{
"gsub": {
"pattern": """duration=\d{20}""",
"ignore_failure": true,
"tag": "invalid_duration_bugfix",
"field": "syslog5424_msg",
"replacement": "duration=9223372036854775807"
}
}

### What did you see?

In some cases Fortigate logs a number with more than 20 digits as the duration causing the processors to fail.

### What did you expect to see?

Guardrails for this behavior.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.