Private GIT

Skip to content
Snippets Groups Projects
Unverified Commit 37095267 authored by Andrew's avatar Andrew Committed by GitHub
Browse files

Update 10-pf.conf

parent 003ab94c
Branches
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 2 additions and 2 deletions
conf.d/10-pf.conf
+ 2
− 2
View file @ 37095267
...@@ -3,10 +3,10 @@ filter { ...@@ -3,10 +3,10 @@ filter {
if "pf" in [tags] { if "pf" in [tags] {
grok { grok {
# OPNsense - Enable/Disable the line below based on firewall platform # OPNsense - Enable/Disable the line below based on firewall platform
match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program} %{GREEDYDATA:syslog_message}" ] match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
# OPNsense # OPNsense
# pfSense - Enable/Disable the line below based on firewall platform # pfSense - Enable/Disable the line below based on firewall platform
# match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ] # match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
# pfSense # pfSense
add_field => [ "received_at", "%{@timestamp}" ] add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ] add_field => [ "received_from", "%{host}" ]
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment

Another place to be (or not)