Technical Tip: Add a custom field in FortiGate logs

If a specific field  is necessary in FortiGate logs (for example, for logs classification in the Syslog server), the custom field can be added:

1. Configure a custom field with a value :

config log custom-field
    edit "CustomLog"        
        set name "Class"            <----- Field Name.
        set value "FortiGate-VM"    <----- Field Value.
    next
end

2. Configure the log setting:

config log setting

    set custom-log-fields "CustomLog"

end

All logs in FortiGate will be added with the custom field.  Sample Forward Traffic logs:

Sample System Event Logs:

Logs sent to the syslog server will include this custom field. 

Note:

Changing log field names directly on a FortiGate or FortiGate VM is not supported, as FortiOS relies on a predefined logging structure. The field names are standardized and cannot be modified within the device.