From 44a907e27d9e549fdf69317725ba00b640390bcf Mon Sep 17 00:00:00 2001 From: Andrew <a@3ilson.com> Date: Sun, 6 Oct 2019 20:30:07 -0400 Subject: [PATCH] Update 10-pf.conf --- conf.d/10-pf.conf | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/conf.d/10-pf.conf b/conf.d/10-pf.conf index 5734876..ea16d10 100644 --- a/conf.d/10-pf.conf +++ b/conf.d/10-pf.conf @@ -2,8 +2,12 @@ filter { if "pf" in [tags] { grok { - match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}", - "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ] + # OPNsense - Enable/Disable the line below based on firewall platform + match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ] + # OPNsense + # pfSense - Enable/Disable the line below based on firewall platform + match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ] + # pfSense add_field => [ "received_at", "%{@timestamp}" ] add_field => [ "received_from", "%{host}" ] } -- GitLab