Hi I have just setup an Ubuntu server with graylog and feeding logs from 2 pfSense Firewalls to it. Here’s an example of the message retrieved: “filterlog[14399]: 131,1589461236,igb3,match,pass,in,4,0x0,127,43658,0,DF,6,tcp,52,10.0.28.58,104.121.236.217,58684,443,0,S,1901707583,65280,mss;nop;wsca…

Thanks for the suggestion - I’ll have a look at this to get a better understanding Actually changing the log format on the pfSense to RFC 5424 did the trick - I can now search IP addresses as expected.

Cannot search IP addresses?

Graylog Central (peer support)

system (system) Closed March 7, 2022, 1:24pm 4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Pfsense Syslog issue Graylog Central (peer support)	16	3491	June 16, 2020
Finding ip addresses in message fields Graylog Central (peer support)	4	1268	December 19, 2023
Pfsense Syslog Input Not Working Graylog Central (peer support)	2	987	September 28, 2020
Graylog v3.3 - simple search with numbers (usually) fail Graylog Central (peer support) pipeline-rules	5	1279	October 16, 2020
Log can received from firewall but cannot show in search Graylog Central (peer support)	5	258	September 1, 2022

Cannot search IP addresses?

Related topics