Update 15-others.conf

conf.d/15-others.conf

 # 15-others.conf
 filter {
   if "pf" in [tags] {
-    if [application] =~ /^dhcpd$/ {
+    if [syslog_program] =~ /^dhcpd$/ {
       mutate {
         add_tag => [ "dhcpd" ]
       }
@@ -10,17 +10,17 @@ filter {
         match => [ "message", "%{DHCPD}"]
       }
     } 
-    if [application] =~ /^charon$/ {
+    if [syslog_program] =~ /^charon$/ {
       mutate {
         add_tag => [ "ipsec" ]
       }
     }
-    if [application] =~ /^barnyard2/ {
+    if [syslog_program] =~ /^barnyard2/ {
       mutate {
         add_tag => [ "barnyard2" ]
       }
     }
-    if [application] =~ /^openvpn/ {
+    if [syslog_program] =~ /^openvpn/ {
       mutate {
         add_tag => [ "openvpn" ]
       }
@@ -29,12 +29,12 @@ filter {
         match => [ "message", "%{OPENVPN}"]
       }
     }
-    if [application] =~ /^ntpd/ {
+    if [syslog_program] =~ /^ntpd/ {
       mutate {
         add_tag => [ "ntpd" ]
       }
     }
-    if [application] =~ /^php-fpm/ {
+    if [syslog_program] =~ /^php-fpm/ {
       mutate {
         add_tag => [ "web_portal" ]
       }
@@ -46,7 +46,7 @@ filter {
         lowercase => [ 'pf_ACTION' ]
       }
     }
-    if [application] =~ /^apinger/ {
+    if [syslog_program] =~ /^apinger/ {
       mutate {
         add_tag => [ "apinger" ]
       }