Json Log Parsing

[adem_netsys]

Hi all,

We convert a log I get with API to syslog with logstash and take it to SIEM. Log comes in json format. I need a parser for this. Has anyone written a parser for json before?

thanks in advance

[Rob_SIEM]

Hi Adem, 

Any custom logs we can build parsers for in FortiSIEM, you just need a distinct header format of the log to make it distinguishable from other logs. 

If the data first hits logstash then you have full control to modify how the data appears. The easiest format would be: <timestamp> <hostname> vendor=MyVendor product=MyCustomAppABC json={ ... your json log body received from api .. }

e.g. 2025-06-22T10:10:00Z mystash.example.com vendor=SomeVendor product=SomeVendorsApp json={...}

Then we can easily build a parser to parse this data, and the <eventFormatRecognizer> of the parser can match on the vendor=xxx product=xxx keywords. 

If you update logstash to output in that preferred format attach some sanitized log samples here. 

Thanks,