diff --git a/11-pf.conf b/11-pf.conf
index 0045ec4775fdc3b0cd1b97c83220f5afd8fcc56f..12be6d78f4d95c83654512e0f54f205965c82790 100644
--- a/11-pf.conf
+++ b/11-pf.conf
@@ -60,9 +60,9 @@ filter {
         }
       }
     }
-    if [prog] =~ /^snort/ {
+   if [prog] =~ /^snort/ {
       mutate {
-        add_tag => [ "Snort" ]
+      add_tag => [ "Snort" ]
       }
       grok {
         patterns_dir => ["/etc/logstash/conf.d/patterns"]