Hi I have just setup an Ubuntu server with graylog and feeding logs from 2 pfSense Firewalls to it. Here’s an example of the message retrieved: “filterlog[14399]: 131,1589461236,igb3,match,pass,in,4,0x0,127,43658,0,DF,6,tcp,52,10.0.28.58,104.121.236.217,58684,443,0,S,1901707583,65280,mss;nop;wsca…

Thanks for the suggestion - I’ll have a look at this to get a better understanding Actually changing the log format on the pfSense to RFC 5424 did the trick - I can now search IP addresses as expected.

Cannot search IP addresses?

Graylog Central (peer support)

tmacgbay (Tmacgbay) February 21, 2022, 1:17pm 2

There was another post int he community about searching for IP addresses here… That will probably get you where you want to go.

Topic		Replies	Views
Log can received from firewall but cannot show in search Graylog Central (peer support)	5	281	September 1, 2022
Searching by IP address Graylog Central (peer support)	8	9680	October 23, 2019
Graylog v3.3 - simple search with numbers (usually) fail Graylog Central (peer support) pipeline-rules	5	1323	October 16, 2020
Finding ip addresses in message fields Graylog Central (peer support)	4	1785	December 19, 2023
Graylog Research Graylog Central (peer support)	3	625	March 27, 2018

Cannot search IP addresses?

Related topics