> ## Documentation Index > Fetch the complete documentation index at: https://parser.xdr.ooo/llms.txt > Use this file to discover all available pages before exploring further. # Multiple Event Types: Real FortiGate Traffic and Threat Logs > Create and test a single parser project using official FortiGate Traffic, Web Filter and IPS records. # Multiple Event Types: Real FortiGate Traffic and Threat Logs English narration and permanently visible English captions accompany this recording of the October 31, 2026 Parser Studio Web UI. The examples come from published original manufacturer documentation or upstream-authored test fixtures, not from fabricated demo messages. [Watch in a dedicated video player](https://app.parser.xdr.ooo/training/parser-studio-current-20261031/04-fortinet-multi-type-real/watch.html) · [Download MP4](https://app.parser.xdr.ooo/training/parser-studio-current-20261031/04-fortinet-multi-type-real/scenario-english.mp4) · [English SRT captions](https://app.parser.xdr.ooo/training/parser-studio-current-20261031/04-fortinet-multi-type-real/subtitles-en.srt) · [Read the English transcript](https://app.parser.xdr.ooo/training/parser-studio-current-20261031/04-fortinet-multi-type-real/narration-en.md) ## Practice along with the video Keep this page open to pause or replay the demonstration while working in a second tab. **Before you begin:** [Download all practice samples as a ZIP](https://app.parser.xdr.ooo/training/parser-studio-current-20261031/practice/practice-all.zip) · [Open Parser Studio](https://app.parser.xdr.ooo/) * [Download the two Traffic log records](https://app.parser.xdr.ooo/training/parser-studio-real-scenarios-20261021/practice/04-fortigate-traffic.log) * [Download the Web Filter and IPS (Threat) records](https://app.parser.xdr.ooo/training/parser-studio-real-scenarios-20261021/practice/04-fortigate-threat.log) **Use the source files above exactly as shown in the video.** Each file contains the public documented sample events used during the recording, with source attribution and SHA-256 checksums in the ZIP bundle. ### Copy the exact logs used in the video Use the **copy icon** on each code block, then paste the entire content into Parser Studio. Each line is one unmodified event from the published source. Do not omit difficult events or replace values to force a passing result. #### Traffic group — copy both FortiGate Traffic events **Exact source:** 1745 bytes · **File:** `04-fortigate-traffic.log` · Keep both lines when the file has two events. ```text theme={null} date=2019-05-13 time=16:29:50 logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" eventtime=1557790190452146185 srcip=10.1.100.11 srcport=44258 srcintf="port12" srcintfrole="undefined" dstip=185.244.31.158 dstport=80 dstintf="port11" dstintfrole="undefined" srcuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" dstuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" poluuid="ccb269e0-5735-51e9-a218-a397dd08b7eb" sessionid=381780 proto=6 action="close" policyid=1 policytype="policy" service="HTTP" dstcountry="Germany" srccountry="Reserved" trandisp="snat" transip=172.16.200.2 transport=44258 duration=5 sentbyte=736 rcvdbyte=3138 sentpkt=14 rcvdpkt=5 appcat="unscanned" utmaction="block" countweb=1 crscore=30 craction=4194304 osname="Ubuntu" mastersrcmac="a2:e9:00:ec:40:01" srcmac="a2:e9:00:ec:40:01" srcserver=0 utmref=65497-796 date=2019-05-10 time=11:37:47 logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" eventtime=1557513467369913239 srcip=10.1.100.11 srcport=58012 srcintf="port12" srcintfrole="undefined" dstip=23.59.154.35 dstport=80 dstintf="port11" dstintfrole="undefined" srcuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" dstuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" poluuid="ccb269e0-5735-51e9-a218-a397dd08b7eb" sessionid=105048 proto=6 action="close" policyid=1 policytype="policy" service="HTTP" dstcountry="Canada" srccountry="Reserved" trandisp="snat" transip=172.16.200.2 transport=58012 appid=34050 app="HTTP.BROWSER_Firefox" appcat="Web.Client" apprisk="elevated" applist="g-default" duration=116 sentbyte=1188 rcvdbyte=1224 sentpkt=17 rcvdpkt=16 utmaction="allow" countapp=1 osname="Ubuntu" mastersrcmac="a2:e9:00:ec:40:01" srcmac="a2:e9:00:ec:40:01" srcserver=0 utmref=65500-742 ``` #### Threat group — copy the Web Filter and IPS events **Exact source:** 1373 bytes · **File:** `04-fortigate-threat.log` · Keep both lines when the file has two events. ```text theme={null} date=2019-05-13 time=16:29:45 logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vdom1" eventtime=1557790184975119738 policyid=1 sessionid=381780 srcip=10.1.100.11 srcport=44258 srcintf="port12" srcintfrole="undefined" dstip=185.244.31.158 dstport=80 dstintf="port11" dstintfrole="undefined" proto=6 service="HTTP" hostname="morrishittu.ddns.net" profile="test-webfilter" action="blocked" reqtype="direct" url="/" sentbyte=84 rcvdbyte=0 direction="outgoing" msg="URL belongs to a denied category in policy" method="domain" cat=26 catdesc="Malicious Websites" crscore=30 craction=4194304 crlevel="high" date=2019-05-15 time=17:56:41 logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" eventtime=1557968201 severity="critical" srcip=10.1.100.22 srccountry="Reserved" dstip=172.16.200.55 srcintf="port10" srcintfrole="lan" dstintf="port9" dstintfrole="wan" sessionid=4017 action="dropped" proto=6 service="HTTP" policyid=1 attack="Adobe.Flash.newfunction.Handling.Code.Execution" srcport=46810 dstport=80 hostname="172.16.200.55" url="/ips/sig1.pdf" direction="incoming" attackid=23305 profile="block-critical-ips" ref="http://www.fortinet.com/ids/VID23305" incidentserialno=582633933 msg="applications3: Adobe.Flash.newfunction.Handling.Code.Execution," crscore=50 craction=4096 crlevel="critical" ``` ### Follow the current on-screen steps 1. Open **Auto Parser**, enter manufacturer **Fortinet** and product **FortiGate**. 2. Choose **Add Another Log Type**. Name the two groups **Traffic** and **Threat**, preserving two published source events in each group. 3. Click **Analyze Logs** and check all four events; the recorded source review returned **4 of 4 log events parsed completely**. 4. In **Review Fields**, inspect event-specific values for Traffic, Web Filter and IPS. Continue to **Map Fields** and verify each mapping against the actual source. 5. If the product accepts the shared parser draft, proceed to **Create Parser**, run **Run Final Test & Create Files**, then download and review the package. A successful sample test cannot prove all FortiGate event shapes. ### Video chapter timestamps (October 31 recording) | Time | Actual recorded step | | - | - | | 00:01 | Multiple Log Types | | 00:07 | Identify Fortigate | | 00:11 | Add Another Log Type | | 00:17 | Set Names And Logs | | 00:23 | Analyze All Types | | 00:28 | Verify Coverage | | 00:34 | Review Data | | 00:38 | Normalize Mappings | | 00:45 | Create Combined Draft | | 00:50 | Final Test | | 00:55 | Download Package | | 01:00 | Verify Each Type | *The listed times come from the actual October 31 recording, not the retired version.* ## Expected review outcome Four original Fortinet documentation log examples parse completely in one project. The final four-event test and package generation pass. Do not treat successful source extraction or generated files as evidence of full vendor/firmware coverage, target import acceptance, or live Stellar Cyber deployment compatibility. ## Recovery path For a different log shape, keep the original records and examine the highlighted source spans, following the [related workflow](https://parser.xdr.ooo/scenarios/mixed-events.md). Only apply additional parsing rules after different examples pass a separate regression test. Never delete failing events merely to obtain a passing total. ## Original log provenance * [Fortinet Document Library: Sample logs by log type](https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/986892/sample-logs-by-log-type) The published traffic and web-filter records share a session ID. These example logs are not claimed to be from a physical appliance independently inspected in this video. > [!NOTE] > > Customer logs may include private information. Review, sanitize and manually approve any excerpt before copying it into an external ChatGPT conversation. The Auto Parser does not automatically share those logs. [All video tutorials](https://parser.xdr.ooo/videos/index.md) · [Launch Parser Studio](https://app.parser.xdr.ooo/) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.