seanthegeek / graylog-fortigate-syslog

A Graylog Content Pack of dashboards for FortiGate syslog data
https://seanthegeek.net/1270/how-to-create-a-single-node-graylog-instance-and-analyze-fortigate-logs/
Apache License 2.0
32 stars 8 forks source link

Stream RegEx not broad enough #9

Closed SD-Miles closed 6 months ago

SD-Miles commented 8 months ago

As of this writing, the stream in this content pack matches FortiGate serial numbers based on the regular expression ^FG([0-9]{2,3})[A-Z]T|^FGT. Without giving away the serial number, I have a FortiGate with a serial which follows this pattern:

I revised the RegEx in my deployment to ^FG([0-9]{2,3}[A-Z]T|[A-Z0-9]+) and this works for me. But I am not a RegEx expert (or even fluent) and I don't know the full spectrum of possible FortiGate serials, so please consider it just a starting point for revision.

DarNattp commented 7 months ago

please show example for fortigate log