Logs are routed to default stream & only processed into FortiGate Syslog a day later

[Rudiedevries]

We have data/logs coming into the Graylog server, but it goes directly into the default stream.

When testing the "FortiGate Syslog" stream rule against logs being received, it stated " This message would be routed to this stream!"

But its still routing into the default, please advise...

When the solution is left over night it seems that it does process the logs into the correct stream, but this only happened afterhours, and i am not sure if this moved all data as well.

[seanthegeek]

Try with the latest release. I updated the stream regex rule to cover more serial numbers.