FortiWeb JSON Packet Logs over TLS Syslog – FortiSIEM Parsing Support
We are currently configuring FortiWeb (v7.2.1+) to send packet logs via Syslog using TCP/TLS in JSON format as per the supported configuration:
set port 6514
set proto tls
set format json
set packet enable
We are sending these JSON packet logs directly to FortiSIEM.
The logs are successfully received; however, they are not being parsed correctly and no structured fields are extracted from the JSON payload.
Considering that sending packet logs via TLS Syslog in JSON format is supported from FortiWeb v7.2.1:
Has Fortinet provided any official parser or XML-based custom parser for FortiWeb JSON packet logs in FortiSIEM?
Is there a recommended configuration or event format required for proper JSON field extraction?
Is direct ingestion and parsing of FortiWeb JSON packet logs into FortiSIEM officially supported?
Currently, FortiSIEM appears to ingest these logs as raw syslog messages without JSON field-level normalization.
Has anyone successfully implemented a working parser for FortiWeb JSON packet logs in FortiSIEM?