From 3709526714f14d78f547e19b3e13cfdd1a66c6c1 Mon Sep 17 00:00:00 2001
From: Andrew <a@3ilson.com>
Date: Sun, 6 Oct 2019 20:52:43 -0400
Subject: [PATCH] Update 10-pf.conf
---
conf.d/10-pf.conf | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/conf.d/10-pf.conf b/conf.d/10-pf.conf
index 9a4d8ec..d9b2eff 100644
--- a/conf.d/10-pf.conf
+++ b/conf.d/10-pf.conf
@@ -3,10 +3,10 @@ filter {
if "pf" in [tags] {
grok {
# OPNsense - Enable/Disable the line below based on firewall platform
- match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program} %{GREEDYDATA:syslog_message}" ]
+ match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
# OPNsense
# pfSense - Enable/Disable the line below based on firewall platform
- # match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
+ # match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
# pfSense
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
--
GitLab