diff --git a/conf.d/10-pf.conf b/conf.d/10-pf.conf index 603a4431badacb6a8bc480f7cf3760c22b74e93a..52f5c0133f444e9f83b71899128a561174875b8f 100644 --- a/conf.d/10-pf.conf +++ b/conf.d/10-pf.conf @@ -2,7 +2,10 @@ filter { if "pf" in [tags] { grok { + #OPNSense match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } + #pfSense + #match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => [ "received_at", "%{@timestamp}" ] add_field => [ "received_from", "%{host}" ] }