# FortiGate Netflow logs to Zeek or Filebeat to ElasticSearch

**URL:** <https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562>\
**Category:** Security\
**Created:** [November 10, 2021, 10:50am UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562 "2021-11-10T10:50:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bleckmeister1g](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@bleckmeister1g](https://forum.opensearch.org/u/bleckmeister1g)\
**Post date:** [November 10, 2021, 10:50am UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/1 "2021-11-10T10:50:46Z")

</div>

Greetings to the community.

Im very very new to the Elasticsearch and i have just started to use it. I installed the OpenDistro 7.10.2 version with the wazuh plugin and so far im getting Host logs successfully. But i need to add Network Based detection as well.

Our company has multiple fortinet firewalls (fortigate) and i want to send netflow logs to FileBeat-OSS or ZEEK and then to ElasticSearch.

So far i can only find the modules in regular filebeat but not in the OSS version and as far as i know i can’t connect normal filebeat to OpenDistro for ES.

Is there any advice or workaround that i can use??

Thanks in advance

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 10, 2021, 1:08pm UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/2 "2021-11-10T13:08:21Z")

</div>

@bleckmeister1g could you share your filebeat config?

You can find filebeat oss [here](https://www.elastic.co/downloads/beats/filebeat-oss).

---

<div class="post-metadata">

**Author:** ![bleckmeister1g](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@bleckmeister1g](https://forum.opensearch.org/u/bleckmeister1g)\
**Post date:** [November 10, 2021, 1:59pm UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/3 "2021-11-10T13:59:37Z")

</div>

hey thanks for replying. the config isnt the problem. I cant find fortinet and zeek modules inside modules.d directory

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 10, 2021, 6:32pm UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/4 "2021-11-10T18:32:57Z")

</div>

@bleckmeister1g Sorry, I misunderstood. I thought you have Filebeat to ES connection issue.

Have you tried connect with regular filebeat already?

---

<div class="post-metadata">

**Author:** ![robcowart](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/robcowart/32/1012_2.png) [@robcowart](https://forum.opensearch.org/u/robcowart)\
**Post date:** [November 16, 2021, 4:59pm UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/5 "2021-11-16T16:59:53Z")

</div>

You might want to consider ElastiFlow. The Basic Tier license is free. Fortinet doesn’t send any vendor-specific fields, so unless you a larger number of flows/sec, the Basic license should be fine.

> **[Introduction | ElastiFlow](https://docs.elastiflow.com/docs/)**
>
> ElastiFlow™ Unified Flow Collector

---

<div class="post-metadata">

**Author:** ![bleckmeister1g](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@bleckmeister1g](https://forum.opensearch.org/u/bleckmeister1g)\
**Post date:** [November 16, 2021, 9:06pm UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/6 "2021-11-16T21:06:11Z")

</div>

So i could replace my filebeat(and other beats) + logstash with this? Could elastiFlow be the focal point of incoming netflows from cisco, fortigate and wifi etc etc?

Actually to be precise i want to analyze incoming data with zeek/suricata rules and send alerts and visualize the data to kibana. If elastiFlow can do that then im all for it.

---

<div class="post-metadata">

**Author:** ![robcowart](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/robcowart/32/1012_2.png) [@robcowart](https://forum.opensearch.org/u/robcowart)\
**Post date:** [November 17, 2021, 7:46am UTC](https://forum.opensearch.org/t/fortigate-netflow-logs-to-zeek-or-filebeat-to-elasticsearch/7562/7 "2021-11-17T07:46:46Z")

</div>

Sorry, I should have been more specific. ElastiFlow is for Netflow, IPFIX and sFlow. It would handle the Netflow data from Fortinet.

For Suricata you might want to take a look at an older project of mine…  
[https://github.com/robcowart/synesis\_lite\_suricata](https://github.com/robcowart/synesis_lite_suricata)  
It will require some updates for the latest versions of OpenSearch and Logstash, but should provide a reasonable starting place.