Update 10-syslog.conf

Cleaned up

10-syslog.conf

 filter {
   if [type] == "syslog" {
-    #change to pfSense ip address
-    if [host] =~ /192\.168\.1\.1/ {
+    if [host] =~ /10\.0\.0\.1/ {
       mutate {
-        add_tag => ["PFSense1", "Ready"]
+        add_tag => ["pfsense", "Ready"]
       }
     }
-#Add following and repeat for multiple 
-#   if [host] =~ /192\.168\.1\.200/ {
-#     mutate {
-#       add_tag => ["PFSense2", "Ready"]
-#     }
-#   }
+    if [host] =~ /172\.2\.22\.1/ {
+      mutate {
+        add_tag => ["pfsense-2", "Ready"]
+      }
+    }
+
     if "Ready" not in [tags] {
       mutate {
         add_tag => [ "syslog" ]
@@ -47,8 +46,5 @@ filter {
     mutate {
       remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
     }
-#    if "_grokparsefailure" in [tags] {
-#      drop { }
-#    }
   }
 }