diff --git a/conf.d/15-others.conf b/conf.d/15-others.conf index 406f7ab72f85cf43eb4d0879f9bfd9b30d063062..5ba47a8b255fc853c144e56ec3619d9acecb246b 100644 --- a/conf.d/15-others.conf +++ b/conf.d/15-others.conf @@ -1,7 +1,7 @@ # 15-others.conf filter { if "pf" in [tags] { - if [application] =~ /^dhcpd$/ { + if [syslog_program] =~ /^dhcpd$/ { mutate { add_tag => [ "dhcpd" ] } @@ -10,17 +10,17 @@ filter { match => [ "message", "%{DHCPD}"] } } - if [application] =~ /^charon$/ { + if [syslog_program] =~ /^charon$/ { mutate { add_tag => [ "ipsec" ] } } - if [application] =~ /^barnyard2/ { + if [syslog_program] =~ /^barnyard2/ { mutate { add_tag => [ "barnyard2" ] } } - if [application] =~ /^openvpn/ { + if [syslog_program] =~ /^openvpn/ { mutate { add_tag => [ "openvpn" ] } @@ -29,12 +29,12 @@ filter { match => [ "message", "%{OPENVPN}"] } } - if [application] =~ /^ntpd/ { + if [syslog_program] =~ /^ntpd/ { mutate { add_tag => [ "ntpd" ] } } - if [application] =~ /^php-fpm/ { + if [syslog_program] =~ /^php-fpm/ { mutate { add_tag => [ "web_portal" ] } @@ -46,7 +46,7 @@ filter { lowercase => [ 'pf_ACTION' ] } } - if [application] =~ /^apinger/ { + if [syslog_program] =~ /^apinger/ { mutate { add_tag => [ "apinger" ] }