Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

how to download logs from Fortigate in CSV format



I am using Fortigate appliance and using the local GUI for managing the firewall. In the logs I can see the option to download the logs. But the download is a .log file format. How can I download the logs in CSV / excel format. Is there a way to do that. I am not using forti-analyzer or manager. 


Or is there a tool to convert the .log file to csv format. I am using forti-OS 5.6.2


appreciate any help.




Hi Sebastan


i try with fileviewer plus. its support .log file. once open it copy and past to excel and use data-->text to colums feature in excel to convert.


hope helps you





That works great with CSV format, but these file are not in that format.

this format does not turn into a please set of columns.



date=2019-05-07 time=08:17:29 logid="0102043040" type="event" subtype="user" level="notice"

Tim Melton


System Administrator/DBA

Tim Melton Cimtel System Administrator/DBA
New Contributor III

Hi there, 


I know the last post has been a while back, but wondering if there's a latest answer to the question? 

Having similar issue importing the log into excel. Or is it meant to be this way? 



Esteemed Contributor III

I want to say you can export the logs form fortianalyzer and achieve this.


Ken Felix




PCNSE NSE StrongSwan
New Contributor

But, how?  If you are viewing Forward Traffic, apply some filters, then click the Download button to get only the data you want, you can't get a CSV.  It only gives you *.log file with the text saved as above.


Is there some other method?


Or, a pattern for importing into Excel to convert to columns with headers?

Esteemed Contributor III

Just download the file from the webUI it will be in tab seperated


e.g adownload tlog;


date=2020-07-15 time=20:59:40 logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1594871980266791507 tz="-0700" srcip= srcport=47269 srcintf="lan" srcintfrole="lan" dstip= dstport=15000 dstintf="wan1" dstintfrole="wan" srccountry="Reserved" dstcountry="China" sessionid=2038461 proto=6 action="deny" policyid=0 policytype="policy" service="tcp/15000" trandisp="noop" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel="high"


Another option is to use the cli and display the log and set filters and capture it to a file


 execute log filter category   0

 execute log filter field dstcountry china  

 execute log display


If you need CSV, just remove the tab and replace tab with commas




 sed 's/ /,/g' > tlog.csv


You have hundred of options on what you can do. You just have to be creative.Also don't forget if you do not havr a remote-log like fortianalyzer you can export logs to a syslog and facility and then do any manipulation on the syslog host


 oh to export logs via syslog in csv change the settings


config log syslogd setting set status enable set mode reliable set port 6514 set format csv set enc-algorithm high set ssl-min-proto-version TLSv1-1 set certificate "fgt1-new1" end



Ken Felix







PCNSE NSE StrongSwan

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors