Hi I have just setup an Ubuntu server with graylog and feeding logs from 2 pfSense Firewalls to it. Here’s an example of the message retrieved: “filterlog[14399]: 131,1589461236,igb3,match,pass,in,4,0x0,127,43658,0,DF,6,tcp,52,10.0.28.58,104.121.236.217,58684,443,0,S,1901707583,65280,mss;nop;wsca…

Thanks for the suggestion - I’ll have a look at this to get a better understanding Actually changing the log format on the pfSense to RFC 5424 did the trick - I can now search IP addresses as expected.

Cannot search IP addresses?

Graylog Central (peer support)

tmacgbay (Tmacgbay) February 21, 2022, 1:17pm 2

There was another post int he community about searching for IP addresses here… That will probably get you where you want to go.

Topic		Replies	Views
Log can received from firewall but cannot show in search Graylog Central (peer support)	4	287	August 18, 2022
Searching by IP address Graylog Central (peer support)	7	9724	October 9, 2019
Graylog v3.3 - simple search with numbers (usually) fail Graylog Central (peer support) pipeline-rules	4	1325	October 2, 2020
Finding ip addresses in message fields Graylog Central (peer support)	3	1816	December 5, 2023
Graylog Research Graylog Central (peer support)	2	625	March 13, 2018

Cannot search IP addresses?

Related topics