Pfsense logs to graylogs

Graylog Central (peer support)
1

Apologies if this has already been asked. Cant seem to find it anywhere.
I am attempting to send pfsense logs to graylogs. This has been logging for the last couple of weeks however the issue I have is the source IP/hostname says filterlogs. Every other server sending logs to graylogs seems to be fine.

Sending pfsense logs to splunk seems to be fine. This has lead me to believe there is something, perhaps a setting, in graylogs that I may have missed. HAs any one come across this at all?
thanks

2

Hey @dj077,

take a look here regarding pfsense extractors :slight_smile:

It seems that Graylog has some issue with the pfsense syslog format. Actually, is it syslog that pfsense is sending?

Greetings - Phil

3

I had a look at the parser and it looks to me it is not doing things very smartly.
Based on the protocol descript one could scoop up multiple fields instead of doing the whole regex again and again.

4

Thanks Phil. I will take a look at this a bit more later today. thanks for the pointer

5

Always good to have a helpful community. Thank you