Hi All :slight_smile: I am very new to Graylog, very quickly realizing how powerful the product it I have a pfSense Firewall with SNORT installed, which works great. SNORT outputs the logs to the System Logs in pfSense and pfSense outputs the logs via SYSLOG to Greylog All of the logs are arrivin…

Hiya Scott, I think your regex is a little too complicated - you also anchored it on something that’ll never match because \s? just means “is there a space”… For example, taking these messages: snort[87537]: [136:1:1] (spp_reputation) packets blacklisted [Classification: Potentially Bad Traffic]…

That’s exactly what I was thinking: this smells like it needs a nice grok-pattern.

pfSense SNORT SYSLOG Log Parsing

Graylog Central (peer support)

Topic		Replies	Views
Pfsense snort, logs not parsing correctly Graylog Central (peer support)	14	2513	December 19, 2018
Graylog Pfsense Snort Regex Graylog Central (peer support) pipeline-rules , debuggingpl	1	1178	January 5, 2020
Pfsense Snort logs not parsing (Resolved) Graylog Central (peer support)	5	3243	October 3, 2018
Parsing Snort Logs w/ Regex Graylog Central (peer support) pipeline-rules	2	1440	June 6, 2020
My regex for snort is not working Graylog Central (peer support) pipeline-rules	7	1111	June 7, 2020

pfSense SNORT SYSLOG Log Parsing

Related topics