Configure FortiAnalyzer-BigData Hyperscale Ingestion

By default, the Hyperscale ingestion is disabled in the Security Event Manager. You can also configure FortiAnalyzer-BigData to forward Hyperscale Syslog messages to an external Syslog UDP server:

To configure Hyperscale Ingestion:

1. Go to Cluster Manager > Services > Core.
2. Click the Configuration tab and go to the Hyperscale Ingestion section.
3. Toggle Enable Persisting to enable or disable persisting the logs into the Security Event Manager. This is disabled by default.
4. Toggle Enable Syslog Forwarding to enable or disable forwarding to an external Syslog UDP server. This is disabled by default.
5. When Enable Syslog Forwarding is on, configure the destination Syslog UDP server’s IP and port.
6. Click Save and follow the prompts to apply the configuration.