How to add custom field in FortiGate logs

This article describes how to add a custom field in FortiGate logs.

Scope

FortiGate, Logs

Solution

If there is a need for a specific field in FortiGate logs (for example for logs classification in the Syslog server), the custom field can be added:

Configure a custom field with a value :

config log custom-field
edit "CustomLog"
set name "Class" <----- Field Name.
set value "FortiGate-VM" <----- Field Value.
next
end

Configure in log setting:

config log setting
set custom-log-fields "CustomLog"
end

All logs in FortiGate will be added with the custom field. Sample Forward Traffic logs:

Sample System Event Logs:

Logs sent to the syslog server will include this custom field.