Technical Note: Using custom index to speed up Log View

Description

Custom index can be used on FortiAnalyzer to accelerate searching through logs and load the results faster.

Solution

FortiAnalyzer

Solution

Example:

config system sql
    config custom-index
        edit <Integer>
            set device-type Fortigate
            set index-field <Field_Name>
            set log-type <Type>
        next 
    end
end

Use '?' to list available index fields and log types:

set index-field ?
set log-type ?

config custom-skipidx
    edit 2
        set device-type FortiGate
        set log-type traffic
        set index-field srcip
    next
end

Verify Skip Index Status:

diagnose test application fazsvcd 2
skip-index:status=Enabled grpstatu=Enabled aggstatus=Enabled nr-chk=0 nr-run=0 avg-run=0.000(sec), nr-agg-run=0 avg-agg-run=0.000(sec) logview-helper: select-run=0 count-run=0

Set Traffic Log Filter to Source IP and download the logs: