Hi All :slight_smile: I am very new to Graylog, very quickly realizing how powerful the product it I have a pfSense Firewall with SNORT installed, which works great. SNORT outputs the logs to the System Logs in pfSense and pfSense outputs the logs via SYSLOG to Greylog All of the logs are arrivin…

Hiya Scott, I think your regex is a little too complicated - you also anchored it on something that’ll never match because \s? just means “is there a space”… For example, taking these messages: snort[87537]: [136:1:1] (spp_reputation) packets blacklisted [Classification: Potentially Bad Traffic]…

That’s exactly what I was thinking: this smells like it needs a nice grok-pattern.

pfSense SNORT SYSLOG Log Parsing

Graylog Central (peer support)

Topic		Replies	Views
Pfsense snort, logs not parsing correctly Graylog Central (peer support)	13	2514	December 5, 2018
Graylog Pfsense Snort Regex Graylog Central (peer support) pipeline-rules , debuggingpl	0	1180	December 22, 2019
Pfsense Snort logs not parsing (Resolved) Graylog Central (peer support)	4	3244	September 19, 2018
Parsing Snort Logs w/ Regex Graylog Central (peer support) pipeline-rules	1	1443	May 23, 2020
My regex for snort is not working Graylog Central (peer support) pipeline-rules	6	1111	May 24, 2020

pfSense SNORT SYSLOG Log Parsing

Related topics