[Filebeat][Fortinet Module] Triage on changes needed to add support for FortiAnalyzer

[P1llus]

Forwarding logs from Fortinet products from Fortianalyzer is a common usecase scenario. Research needs to be put into how this affects current and any future filesets on this module, to add support for both.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[fredtj]

I've ticketed Fortinet on this issue and they weren't very helpful. They basically said they could find no mention of these fields in their documentation and also said they "think" it is not possible to turn them off. I have asked for clarification from them:

Basically, the FAZ is adding (at least) 2 fields to forwarded logs:

tz (sometimes already exists in original log message and is added again by FAZ)
timestamp (already exists as eventtime in original log message and is added again as timestamp by FAZ)

There is no mention of these fields in your documentation.

Can you please confirm:

1. Are we able to disable these extra fields?
2. Are there any other fields we should be aware of that FAZ may add to forwarded log messages?

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)