diff --git a/conf.d/10-pf.conf b/conf.d/10-pf.conf index 9a4d8ec8a6b1c3217edd61b72c9e38c528d31f6b..d9b2efff3f9114703720c9f0ba8d16daf221654e 100644 --- a/conf.d/10-pf.conf +++ b/conf.d/10-pf.conf @@ -3,10 +3,10 @@ filter { if "pf" in [tags] { grok { # OPNsense - Enable/Disable the line below based on firewall platform - match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program} %{GREEDYDATA:syslog_message}" ] + match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } # OPNsense # pfSense - Enable/Disable the line below based on firewall platform - # match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ] + # match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } # pfSense add_field => [ "received_at", "%{@timestamp}" ] add_field => [ "received_from", "%{host}" ]