# Having issues with my PF sense configs

**URL:** <https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438>\
**Category:** Logstash\
**Created:** [October 6, 2019, 7:07am UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438 "2019-10-06T07:07:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [October 6, 2019, 7:07am UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438/1 "2019-10-06T07:07:00Z")

</div>

I'm having issues with getting my PF sense logs to parse properly. The current result is that everything is dropped and I am uncertain why.  
I am using the config files from this github: [https://github.com/a3ilson/pfelk](https://github.com/a3ilson/pfelk)

I get this error:  
`[2019-10-06T00:16:31,031][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.4.0"}`  
`[2019-10-06T00:16:32,625][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 45, column 28 (byte 844) after filter {\n if \"pf\" in [tags] {\n grok {\n match => [\"message\" ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in`compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in`block in compile\_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in`compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:26:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}`

I am uncertain what the issue is as I do get data into logstash and I can find no issues with the code that I am using. I thought this might be due to a version of logstash issue (i was on 6.x and I upgraded to 7.x to try to resolve) but the upgrade didn't fix anything.

I believe this is the file that is triggering the issue.

```
# 10-pf.conf
filter {
  if "pf" in [tags] {
    grok {
      match => ["message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}",
     "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    mutate {
      rename => { "[message]" => "[event][original]"}
    }
  }
}

```

Any assistance would be appreciated

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 6, 2019, 1:36pm UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438/2 "2019-10-06T13:36:54Z")

</div>

> [@JeMunos](#):
>
> match =\> [ "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp}

match expects a hash.

```
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} ...

```

---

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [October 6, 2019, 3:51pm UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438/3 "2019-10-06T15:51:42Z")

</div>

So perhaps I don't understand the issue correctly (forgive me I'm a newb here). You said that match is expecting a hash, then gave me a modification of the match string using {} instead of . So I updated the code as follows to try to fix it:

```
# 10-pf.conf
filter {
  if "pf" in [tags] {
grok {
  match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}",
             "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  add_field => ["received_at", "%{@timestamp}"]
  add_field => ["received_from", "%{host}"]
}
mutate {
  rename => { "[message]" => "[event][original]"}
}
}
}

```

This results in a slightly different error:

```
[2019-10-06T09:07:38,229][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.4.0"}
[2019-10-06T09:07:40,007][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 53, column 180 (byte 1097) after filter {\n if \"pf\" in [tags] {\n grok {\n match => { \"message\" => \"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}\"", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}
[2019-10-06T09:07:40,327][INFO][logstash.runner] Logstash shut down.

```

Perhaps you were suggesting that I have to change the datatype being passed into match, or use a different method all together?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 6, 2019, 3:55pm UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438/4 "2019-10-06T15:55:24Z")

</div>

> [@JeMunos](#):
>
> ```
> match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}", 
> "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"]
> 
> ```

The key value pairs in a hash are not comma separated. So you can get past that error message by using

```
match => { "message" => "some pattern"
                    "message" => "some other pattern" }

```

However, if you want to match [message] against multiple patterns then you should use

```
match => { "message" => ["some pattern", "some other pattern"] }

```

---

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [October 6, 2019, 5:06pm UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438/5 "2019-10-06T17:06:59Z")

</div>

Thank you. Changing it to use the multiple pattern approach resolved my issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2019, 5:30pm UTC](https://discuss.elastic.co/t/having-issues-with-my-pf-sense-configs/202438/7 "2019-11-03T17:30:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.