elastic / elastic/integrations
[Fortinet Fortigate]: Fortigate's standard value for invalid sessions is too long for component template field type
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
### Integration Name
Fortinet FortiGate Firewall Logs [packages/fortinet_fortigate]
### Dataset Name
fortinet_fortigate.log
### Integration Version
1.34.0
### Agent Version
9.3.5
### Agent Output Type
logstash
### Elasticsearch Version
9.3.5
### OS Version and Architecture
Docker
### Software/API Version
_No response_
### Error Message
Invalid Value
### Event Original
N/A, Couldn't find the logs anymore.
### What did you do?
gsubbed values longer than 20 digits with the maximum value for the configured field type.
{
"gsub": {
"pattern": """duration=\d{20}""",
"ignore_failure": true,
"tag": "invalid_duration_bugfix",
"field": "syslog5424_msg",
"replacement": "duration=9223372036854775807"
}
}
### What did you see?
In some cases Fortigate logs a number with more than 20 digits as the duration causing the processors to fail.
### What did you expect to see?
Guardrails for this behavior.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.