# Grok Patterns? for OpenVPN

**URL:** <https://discuss.elastic.co/t/grok-patterns-for-openvpn/52265>\
**Category:** Logstash\
**Created:** [June 8, 2016, 10:47pm UTC](https://discuss.elastic.co/t/grok-patterns-for-openvpn/52265 "2016-06-08T22:47:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\
**Post date:** [June 8, 2016, 10:47pm UTC](https://discuss.elastic.co/t/grok-patterns-for-openvpn/52265/1 "2016-06-08T22:47:47Z")

</div>

Hi,  
I Have been trying for many months and no luck on getting this to  
work to filter the logs from pfSense and Send them to ELK. I am not  
sure where i should be looking at? This is what I have

`filter{ if [type] == "OpenVPN_log" { #drop{} grok{ match => { "message" => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR} %{USERNAME}/%{IP:src_ip}:%{BASE10NUM} TLS: Username/Password authentication succeeded for username '%{USERNAME:username}' [CN SET]"} add_tag => "VPN_Success" } }}`  
But on ELK it showsing something differnt on the RAW

`{ "_index": "logstash-2016.06.08", "_type": "syslog", "_id": "Jo75DVZpR-iVZ6yBmFu2dg", "_score": null, "_source": { "message": "181.137.XXX.XXX:52777 [casa] Peer Connection Initiated with [AF_INET]181.137.XXX.XXX:52777", "@version": "1", "@timestamp": "2016-06-08T22:28:53.000Z", "type": "syslog", "host": "192.168.3.254", "tags": ["PFSense", "firewall"], "evtid": "29", "prog": "openvpn[50853]" }, "sort": [1465424933000, 1465424933000] }`

and this

`{ "_index": "logstash-2016.06.08", "_type": "syslog", "_id": "KkzovBpTRFS53tIxFYUHmA", "_score": null, "_source": { "message": "user 'casa' authenticated", "@version": "1", "@timestamp": "2016-06-08T22:28:53.000Z", "type": "syslog", "host": "192.168.3.254", "tags": ["PFSense", "firewall"], "evtid": "37", "prog": "openvpn" }, "sort": [1465424933000, 1465424933000] }`

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2771755ee25bef9edcf07a1b81c394a248f3071f.png)

Thank you

---

<div class="post-metadata">

**Author:** ![mourlos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mourlos/32/10788_2.png) [@mourlos](https://discuss.elastic.co/u/mourlos)\
**Post date:** [June 8, 2016, 11:16pm UTC](https://discuss.elastic.co/t/grok-patterns-for-openvpn/52265/2 "2016-06-08T23:16:08Z")

</div>

Hi,

I am not sure if I understood correctly, but you cannot parse the PfSense logs on ELK.  
First, if the information you have provided :

> But on ELK it showsing something differnt on the RAW\>

is the raw message, then your filter will never work as you apply the filter only for OpenVPN\_log type of logs.

Again, I am not sure if I understood correctly.

Secondly, something else worth mentioning is the way that you push your PfSense logs to ELK. You can push them on different formats and based on what you are after, get the best result.  
Personally, I use the csv filter for pfsense logs, to parse traffic and snort data, but have never used openvpn on that.

---

<div class="post-metadata">

**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\
**Post date:** [June 12, 2016, 7:45pm UTC](https://discuss.elastic.co/t/grok-patterns-for-openvpn/52265/3 "2016-06-12T19:45:02Z")

</div>

Hi,  
Thank you for the reply,  
Sorry for not being clear,  
Well when you say cannot parse the pfSense Logs on to ELK I forgot to mention that Im running logstash with grok patterns. Right now I have working the firewall logs no issue there I did someone got working with OpenVPN. Also been trying with Snort logs to parse also no luck there either. These are my logstash and grok patterns

logstash----[http://pastebin.com/5tfVr1eF](http://pastebin.com/5tfVr1eF)  
grok patterns------[http://pastebin.com/2ZQJbAL1](http://pastebin.com/2ZQJbAL1)

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/grok-patterns-for-openvpn/52265/4 "2017-07-06T04:53:28Z")

</div>