diff --git a/11-pf.conf b/11-pf.conf
index fc61eb559cb79cb72086eb7767576cc2c217be8b..e4675ac4d59ea5b657d33ace31d180e21986db43 100644
--- a/11-pf.conf
+++ b/11-pf.conf
@@ -61,6 +61,7 @@ filter {
             if [prog] =~ /^openvpn/ {
               mutate {
                 add_tag => [ "openvpn" ]
+                match =>  [ "message", "%{OPENVPN}"
               }
             }
             if [prog] =~ /^ntpd/ {