# Filebeat can't receive log from pfSense

**URL:** <https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 22, 2020, 7:39am UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859 "2020-05-22T07:39:09Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Minh\_Ti\_n\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/minh_ti_n_tr_n/32/60754_2.png) [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\
**Post date:** [May 22, 2020, 7:39am UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/1 "2020-05-22T07:39:09Z")

</div>

Hi all, I'm trying to make filebeat receive pfsense syslog.  
my filebeat.yml input part:

```
filebeat.inputs:
- type: syslog
  protocol.udp:
    host: "0.0.0.0:9560"
  fields_under_root: true
  fields:
    input.type: pfsense

```

My pfsense config:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc317b87cb61f0ea0fc085fb7e5213f14af9eff1.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af27c9f2abe8780961cd920aa6a2b1d09b95095b.png)

It's connected as syslog show. But I can't find any log come from pfsense.

Please if you know how to resolve it please share with me.  
Thanks & Regards

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 22, 2020, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/2 "2020-05-22T19:20:49Z")

</div>

Hello, Had a similar issue when I setup my pfsense. Solved by setting the real ip of the host instead of 0.0.0.0. Please try that and make sure your local fw allows udp on 9560. Grtz

---

<div class="post-metadata">

**Author:** ![Minh\_Ti\_n\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/minh_ti_n_tr_n/32/60754_2.png) [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\
**Post date:** [May 23, 2020, 2:09pm UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/3 "2020-05-23T14:09:18Z")

</div>

Hi, a staff on elastic stack slask channel tell me to change into 0.0.0.0  
My previous config is the pfsense IP

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 23, 2020, 4:25pm UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/4 "2020-05-23T16:25:09Z")

</div>

Is pfsense running on the host running filebeat?

If not, you could try set the ip of the host..

---

<div class="post-metadata">

**Author:** ![Minh\_Ti\_n\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/minh_ti_n_tr_n/32/60754_2.png) [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\
**Post date:** [May 24, 2020, 11:04am UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/5 "2020-05-24T11:04:30Z")

</div>

they are not on the same server  
After changed into pfsense IP, I got the error on syslog  
`2020-05-24T18:02:29.737+0700#011ERROR#011[syslog]#011syslog/input.go:158#011Error starting the servererrorlisten udp 192.168.1.23:9560: bind: cannot assign requested address`

---

<div class="post-metadata">

**Author:** ![Minh\_Ti\_n\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/minh_ti_n_tr_n/32/60754_2.png) [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\
**Post date:** [May 24, 2020, 11:08am UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/6 "2020-05-24T11:08:13Z")

</div>

When I use 0.0.0.0:9560, I can see port 9560 listening. But when changed to 192.168.1.23:9560, I dont see port 9560 on port running anymore

---

<div class="post-metadata">

**Author:** ![Minh\_Ti\_n\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/minh_ti_n_tr_n/32/60754_2.png) [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\
**Post date:** [May 24, 2020, 11:43am UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/7 "2020-05-24T11:43:35Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e15b563bcca5dfce120ba07e36654261a302f365.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83644ce6cef6cf421deff6761e78bb03ad6f10be.png)  
I use a visual syslog server on Windows and receive log but my ES server does not.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2020, 11:43am UTC](https://discuss.elastic.co/t/filebeat-cant-receive-log-from-pfsense/233859/8 "2020-06-21T11:43:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.