From 8d7b7526508be5a52d60928c2de9e7b8fa301371 Mon Sep 17 00:00:00 2001
From: a3ilson <a@3ilson.com>
Date: Sat, 11 Nov 2017 10:10:54 -0500
Subject: [PATCH] Update 10-syslog.conf
Updated configuration to allow for multiple pfsense ingests
---
10-syslog.conf | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/10-syslog.conf b/10-syslog.conf
index e6310f9..2a9c03d 100644
--- a/10-syslog.conf
+++ b/10-syslog.conf
@@ -3,9 +3,15 @@ filter {
#change to pfSense ip address
if [host] =~ /192\.168\.1\.1/ {
mutate {
- add_tag => ["PFSense", "Ready"]
+ add_tag => ["PFSense1", "Ready"]
}
}
+#Add following and repeat for multiple
+# if [host] =~ /192\.168\.1\.200/ {
+# mutate {
+# add_tag => ["PFSense2", "Ready"]
+# }
+# }
if "Ready" not in [tags] {
mutate {
add_tag => [ "syslog" ]
--
GitLab