# I have a problem when I want to send logs of PFSense (2.5.2 amd64) to EK version 7.14.2 **URL:** \ **Category:** Logstash\ **Created:** [February 18, 2022, 12:02pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603 "2022-02-18T12:02:48Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 18, 2022, 12:02pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/1 "2022-02-18T12:02:48Z")
I have a problem when I want to send logs from PFSense (2.5.2 amd64) to EK version 7.14.2 I did configure PFSense to send logs to EK but I did not find the best procedure to configure Elasticsearch and Kibana (7.14.2) ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 21, 2022, 10:04am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/2 "2022-02-21T10:04:12Z")
kindly note that my os is ubuntu 20.04 ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 10:11am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/3 "2022-02-21T10:11:13Z")
Can you copy your .conf file or debug logs? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 12:31pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/5 "2022-02-21T12:31:09Z")
Have you configured Filebeat or you are planning to use syslog as input? Your input is set for Filebeat. Can you add stdout { codec =\> rubydebug " } and run LS from the command line? ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 21, 2022, 1:26pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/6 "2022-02-21T13:26:13Z")
thanks indeed for your reply , PFSense send syslog to Logstash, So I want to use Syslog as input ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 1:32pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/7 "2022-02-21T13:32:15Z")
You can use pure TCP/UDP plugin ```auto input { tcp { type => "syslog" port => 514 } udp { type => "syslog" port => 514 } } ``` or Syslog plugin(recommended) which will listen on both TCP and UDP protocols. ```auto input { syslog { port => 514 } } ``` After that you will receive a message, which will be need to parse by grok or KV plugin. Do not use JSON plugin/coded for this until you receive a raw massage. ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 21, 2022, 1:41pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/8 "2022-02-21T13:41:26Z")
i did add stdout { codec =\> rubydebug " } and i run LS like you suggest me ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/22a6e16f45478d5de586c6bcf5ad30f095eeca0c.png) we have already use this plugin in " /etc/logstash/conf.d/01-inputs.conf " but it doesn't work . ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 1:59pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/9 "2022-02-21T13:59:05Z")
LS=Logstash, FB=Filebeat 🙂 Try this code, change ES and file params as you wish. ```auto input { syslog { port => 514 } } filter { } output { # write to ES elasticsearch { hosts => ["http://localhost:9200"] index => "syslog-test_%{+YYYY.MM}" } # write to a file file { path => "/var/log/logstash/syslog_%{+YYYY-MM-dd}.txt" } # debug stdout { codec => rubydebug } } ``` ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 21, 2022, 2:37pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/10 "2022-02-21T14:37:06Z")
we did not see logstash send logs to Elasticsearch . also it doesn't create ( var/log/logstash/syslog\_ .txt) and doesn't write logs into ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 2:43pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/11 "2022-02-21T14:43:34Z")
Start Logstash as a process not as the service: `/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/your.conf --path.settings /etc/logstash/` Check does your local host firewall open port `service iptables status` or `firewall-cmd --state` Also you can use tcpdump to check does any traffic coming to your host. ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 21, 2022, 3:54pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/14 "2022-02-21T15:54:43Z")
we can see logs arrive to logstash and written to file (syslog\_.txt) But it can not do the parsing for the raw messages because we did not have grok for pfsense 2.5.2 ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 4:34pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/15 "2022-02-21T16:34:24Z")
Can you copy a message? 1-2 lines. ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 21, 2022, 4:50pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/16 "2022-02-21T16:50:58Z")
![MicrosoftTeams-image (1)](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21fe9eb69cf89f830446734be6dd989c7f703bb3.jpeg) ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 21, 2022, 7:42pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/17 "2022-02-21T19:42:16Z")
Can you put the message as text not as the picture? ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 22, 2022, 11:18am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/18 "2022-02-22T11:18:49Z")
thank you for your response . this is the message as text \<134\>1 2022-02-22T10:59:15.721388+01:00 pfSense.home.arpa filterlog 26305 - - 4,,,1000000103,em0,match,block,in,4,0x0,,242,40756,0,DF,6,tcp,40,2.2.2.2,1.1.1.1,44925,443,0,A,,441544382,62500,, ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 22, 2022, 11:25am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/19 "2022-02-22T11:25:38Z")
> [@khouloud1](#): > > \<134\>1 2022-02-22T10:59:15.721388+01:00 pfSense.home.arpa filterlog 26305 - - 4,,,1000000103,em0,match,block,in,4,0x0,,242,40756,0,DF,6,tcp,40,2.2.2.2,1.1.1.1,44925,443,0,A,,441544382,62500,, Is only this type of message? This looks like TCP, the message on the picture is NGINX. There is [GitHub - pfelk/pfelk: pfSense/OPNsense + Elastic Stack](https://github.com/pfelk/pfelk) for pfSense/OPNsense firewall traffic. However, your lines seems a little different types. ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 23, 2022, 9:26am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/20 "2022-02-23T09:26:45Z")
thank you for your cooperation. By trying to decrypt and identify each message field for parsing. I did not find all the fields and it corresponds to what exactly . for example , message " \<134\>1 2022-02-22T10:59:15.721388+01:00 pfSense.home.arpa filterlog 26305 - - 4,,,1000000103,em0,match,block,in,4,0x0,,242,40756,0,DF,6,tcp,40,2.2.2.2,1.1.1.1,44925,443,0,A,,441544382,62500,," i find only ![CAPTURE](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21f9db152480fdf7072b15fd44ebf49afd95f4c7.png) have you idea please of the other fields of message . ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 23, 2022, 12:17pm UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/21 "2022-02-23T12:17:01Z")
This is version for pfelk/conf.d/01-inputs.conf `<(?.*)>%{INT:sub_rule} (%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?(%{PROG:[process][name]}\:|%{PROG:[process][name]})\s*?(\[)?(%{POSINT:[process][pid]}(\]:)?)?\s*(\-\s*\-)?\s*%{GREEDYDATA:filter_message}` 05-apps.conf is used to parse filter\_message ```auto if [process][name] =~ /^filterlog$/ { grok { patterns_dir => ["/etc/pfelk/patterns"] match => ["filter_message", "%{PF_LOG_ENTRY}"] } ``` PF\_LOG\_ENTRY you will find in patterns, line 53 > [github.com/pfelk/pfelk/blob/main/etc/pfelk/patterns/pfelk.grok](http://github.com/pfelk/pfelk/blob/main/etc/pfelk/patterns/pfelk.grok) I am assuming you will reorganize logic since some fields were changed. Go step by step. ---
**Author:** ![khouloud1](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Post date:** [February 28, 2022, 9:19am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/22 "2022-02-28T09:19:20Z")
thank you very much for your help . Can you please expalin me with more details because i don't find the best solution for my problem. ( i don't have the same files like PFELK ) . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 28, 2022, 9:19am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603/23 "2022-03-28T09:19:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.