Can I create custom Fortianalyzer field-list for exclusions

Welcome to the Fortinet community and Thank you for your post. Hopefully, you've been keeping safe and doing well!

We see you are facing the issue of creating a custom FortiAnalyzer field-list for exclusion.

You should receive an update from one of the team members soon on. Thanks for your patience on this.

Hello jacobcamp,

I checked and found in the FAZ configuration the way to do it.

https://docs2.fortinet.com/document/fortianalyzer/6.0.4/cli-reference/859805/log-forward

config system log-forward

edit <id> --> logid
set mode {aggregation | disable | forwarding}
set fwd-log-source-ip {local_ip | original_ip}
set log-field-exclusion-status {enable | disable} --> need to be enabled
end

config log-field-exclusion
edit <id>
set dev-type {FortiGate | FortiMail | FortiManager | FortiAnalyzer | FortiWeb | FortiCache | FortiSandbox | FortiDDoS | Syslog}
set field-list <string>
set log-type {app-ctrl | attack | content | dlp | emailfilter | event | generic | history | traffic | virus | voip | webfilter | netscan | waf | gtp | dns | ssh | ANY-TYPE}
end

config log-filter
edit <id>
set field {type | logid | level | devid | vd | srcip | srcintf | srcport | dstip | dstintf | dstport | user | group | free-text }
set oper {= | != | < | > | <= | >= | contain | not-contain | match}
set value {traffic | event | utm}
end
end

Let me know if it helps.

Does anyone have a quick example of how to create an exclusion based on DstIP & Destination Port?