Hi All :slight_smile: I am very new to Graylog, very quickly realizing how powerful the product it I have a pfSense Firewall with SNORT installed, which works great. SNORT outputs the logs to the System Logs in pfSense and pfSense outputs the logs via SYSLOG to Greylog All of the logs are arrivin…

Hiya Scott, I think your regex is a little too complicated - you also anchored it on something that’ll never match because \s? just means “is there a space”… For example, taking these messages: snort[87537]: [136:1:1] (spp_reputation) packets blacklisted [Classification: Potentially Bad Traffic]…

That’s exactly what I was thinking: this smells like it needs a nice grok-pattern.

pfSense SNORT SYSLOG Log Parsing

Graylog Central (peer support)

Topic		Replies	Views
Pfsense snort, logs not parsing correctly Graylog Central (peer support)	13	2528	December 5, 2018
Graylog Pfsense Snort Regex Graylog Central (peer support) pipeline-rules , debuggingpl	0	1181	December 22, 2019
Pfsense Snort logs not parsing (Resolved) Graylog Central (peer support)	4	3246	September 19, 2018
Parsing Snort Logs w/ Regex Graylog Central (peer support) pipeline-rules	1	1445	May 23, 2020
My regex for snort is not working Graylog Central (peer support) pipeline-rules	6	1118	May 24, 2020

pfSense SNORT SYSLOG Log Parsing

Related topics