Fortinet Document Library

Version:

Version:


Table of Contents

New Features

Download PDF
Copy Link

Filter syntax enhancement 7.0.1

Enhanced log filter syntax can be applied to the Log Viewer or Event Handler to generate a consistent result.

To use the enhanced log filter syntax:
  1. Before this enhancement, event handlers and Log View used a different filter syntax in the generic text filter.
    For example, filtering "attack not equal to botnet" and "logid equal to 0000000013" in Log View would use the following syntax: (-attack=*botnet* and logid=0000000013). See the example below.

    In order to filter the same content for event handlers, the generic text filter would use the following syntax: (attack!~botnet and logid==0000000013). See the example below.
    Some filter syntax would work well in Log View but not for event handlers. For example: Filters (filter<value, filter>value and -filter=value etc.) may work well in Log View, but not for event handlers.
  2. After this enhancement, FortiAnalyzer provide a unified syntax for Log View and event handlers, meaning users can easily use the same filter syntax for both Log View and event handlers. Additionally, new filter syntax support has been added for both Log View and event handlers.
    Below is a comparison of supported syntax filters before and after this enhancement, including new filter syntax support:

    f: filter, v: value

    Before Enhancement After Enhancement
    Filter sample logview  logview - fabric  logbrowse  event-handler  logview logview - fabric logbrowse event-handler -
    f=v user=test
    f!=v user!=test X
    not f=v not user=test X
    f='', f="", f="''" user='', user="", user="''"
    f!='', f!="", f!="''" user!='', user!="", user!="''" X
    f isnull user isnull X X X X
    f isnotnull user isnotnull X X X X
    f like 'v%' user like 'test%' X X X X
    f like '__v%' user like '__st%' X X X X
    f="v*" user="test*"
    f!="v*" user!="test*" X
    flt and flt user=test and service=http
    flt && flt user=test && service=http
    flt or flt user=test or service=http
    flt || flt user=test || service=http X
    -f=v -user="test" X
    f~v user~"test" X X
    f!~v user!~"test" X X
    f~"v*" user~"test*" X X
    f!~"v*" user!~"test*" X X
    f~"v.*" user~"test.*" X X Does not work for String
    f!~"v.*" user!~"test.*" X X Does not work for String
    f>n, f<n countips>1 countips<1
    f<=n, f>=n countips<=1 countips>=1 X
    f<>v, f<>n user<>"test", countips<>1 X X

Filter syntax enhancement 7.0.1

Enhanced log filter syntax can be applied to the Log Viewer or Event Handler to generate a consistent result.

To use the enhanced log filter syntax:
  1. Before this enhancement, event handlers and Log View used a different filter syntax in the generic text filter.
    For example, filtering "attack not equal to botnet" and "logid equal to 0000000013" in Log View would use the following syntax: (-attack=*botnet* and logid=0000000013). See the example below.

    In order to filter the same content for event handlers, the generic text filter would use the following syntax: (attack!~botnet and logid==0000000013). See the example below.
    Some filter syntax would work well in Log View but not for event handlers. For example: Filters (filter<value, filter>value and -filter=value etc.) may work well in Log View, but not for event handlers.
  2. After this enhancement, FortiAnalyzer provide a unified syntax for Log View and event handlers, meaning users can easily use the same filter syntax for both Log View and event handlers. Additionally, new filter syntax support has been added for both Log View and event handlers.
    Below is a comparison of supported syntax filters before and after this enhancement, including new filter syntax support:

    f: filter, v: value

    Before Enhancement After Enhancement
    Filter sample logview  logview - fabric  logbrowse  event-handler  logview logview - fabric logbrowse event-handler -
    f=v user=test
    f!=v user!=test X
    not f=v not user=test X
    f='', f="", f="''" user='', user="", user="''"
    f!='', f!="", f!="''" user!='', user!="", user!="''" X
    f isnull user isnull X X X X
    f isnotnull user isnotnull X X X X
    f like 'v%' user like 'test%' X X X X
    f like '__v%' user like '__st%' X X X X
    f="v*" user="test*"
    f!="v*" user!="test*" X
    flt and flt user=test and service=http
    flt && flt user=test && service=http
    flt or flt user=test or service=http
    flt || flt user=test || service=http X
    -f=v -user="test" X
    f~v user~"test" X X
    f!~v user!~"test" X X
    f~"v*" user~"test*" X X
    f!~"v*" user!~"test*" X X
    f~"v.*" user~"test.*" X X Does not work for String
    f!~"v.*" user!~"test.*" X X Does not work for String
    f>n, f<n countips>1 countips<1
    f<=n, f>=n countips<=1 countips>=1 X
    f<>v, f<>n user<>"test", countips<>1 X X