Pfsense logs to graylogs

[dj077]

Apologies if this has already been asked. Cant seem to find it anywhere.
I am attempting to send pfsense logs to graylogs. This has been logging for the last couple of weeks however the issue I have is the source IP/hostname says filterlogs. Every other server sending logs to graylogs seems to be fine.

Sending pfsense logs to splunk seems to be fine. This has lead me to believe there is something, perhaps a setting, in graylogs that I may have missed. HAs any one come across this at all?
thanks

[derPhlipsi (Philipp Ruland)]

Hey @dj077,

take a look here regarding pfsense extractors

Rexgex Extractor - for pfsense devices

Hey, here are two solutions: Solution 1: Getting all fields: Two Extractors, first a GROK to remove syslog-header (actually, why is it in there?), second a Copy-Input with csv-converter. [image] The GROK Extractor: [image] The Copy-Input with CSV To Fields converter Note: In the field names attribute, there are 29 fields needed, since the csv is 29 columns wide. Use appropriate names if they are known for better readability. [image] This is the result: [image] Solution 2: Only 20th (n…

It seems that Graylog has some issue with the pfsense syslog format. Actually, is it syslog that pfsense is sending?

Greetings - Phil

[hvdkooij (Hugo van der Kooij)]

I had a look at the parser and it looks to me it is not doing things very smartly.
Based on the protocol descript one could scoop up multiple fields instead of doing the whole regex again and again.

[dj077]

Thanks Phil. I will take a look at this a bit more later today. thanks for the pointer

[dj077]

Always good to have a helpful community. Thank you