# Logstash : Cant filter syslog from Pfsense firewall

**URL:** https://discuss.elastic.co/t/logstash-cant-filter-syslog-from-pfsense-firewall/66404
**Category:** Logstash
**Created:** [November 17, 2016, 2:02pm UTC](https://discuss.elastic.co/t/logstash-cant-filter-syslog-from-pfsense-firewall/66404 "2016-11-17T14:02:21Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Patriote](https://avatars.discourse-cdn.com/v4/letter/p/ecd19e/32.png) [@Patriote](https://discuss.elastic.co/u/Patriote)
#### Post date: [November 17, 2016, 2:02pm UTC](https://discuss.elastic.co/t/logstash-cant-filter-syslog-from-pfsense-firewall/66404/1 "2016-11-17T14:02:21Z")

</div>

hi everyone,  
i have an hard time filtering logs comming from a pfsense firewall  
i tried a lot of filters and groks but nothing's working  
it seems that logstash isnt reading filters or something  
doesnt any one have an idea how to fix that?

here is my filter file

filter {  
if [type] == "syslog" {

```
#change to pfSense ip address
if [host] =~ /172\.16\.52\.250/ {
  mutate {
    add_tag => ["PFSense", "Ready"]
  }
}

if "Ready" not in [tags] {
  mutate {
    add_tag => ["syslog"]
  }
}

```

}  
}

filter {  
if [type] == "syslog" {  
mutate {  
remove\_tag =\> "Ready"  
}  
}  
}

filter {  
if "syslog" in [tags] {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
locale =\> "en"  
}

```
if !("_grokparsefailure" in [tags]) {
  mutate {
    replace => ["@source_host", "%{syslog_hostname}"]
    replace => ["@message", "%{syslog_message}"]
  }
}

mutate {
  remove_field => ["syslog_hostname", "syslog_message", "syslog_timestamp"]
}

```

# if "\_grokparsefailure" in [tags] {

# drop { }

# }

}  
}

BTW: the config is not returning any errors, the logs are recieved by Graylog2 but not filtered and parsed  
here is an exemple

\<14\>Nov 17 14:35:53 172.16.52.250 id=firewall time="2016-11-17 14:50:48" fw="cbv-fw02" tz=+0100 startime="2016-11-17 14:48:48" pri=5 confid=01 slotlevel=2 ruleid=45 srcif="Ethernet1" srcifname="production" ipproto=udp dstif="Vlan2" dstifname="INTERCOFW" proto=dns src=10.56.130.9 srcport=49286 srcportname=ephemeral\_fw\_udp srcname=H\_CBV-DC02 dst=192.168.204.1 dstport=53 dstportname=dns\_udp dstname=cbv-fw01.production.infra modsrc=10.56.130.9 modsrcport=49286 origdst=192.168.204.1 origdstport=53 sent=52 rcvd=204 duration=0.00 logtype="connection"#015#012#000 info

cheers

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 17, 2016, 2:20pm UTC](https://discuss.elastic.co/t/logstash-cant-filter-syslog-from-pfsense-firewall/66404/2 "2016-11-17T14:20:09Z")

</div>

For best chances of getting an answer to your question, please edit your post and move it to the Logstash category.

---

<div class="post-metadata">

### Author: ![aeva\_assured](https://avatars.discourse-cdn.com/v4/letter/a/35a633/32.png) [@aeva\_assured](https://discuss.elastic.co/u/aeva_assured)
#### Post date: [November 17, 2016, 4:54pm UTC](https://discuss.elastic.co/t/logstash-cant-filter-syslog-from-pfsense-firewall/66404/3 "2016-11-17T16:54:58Z")

</div>

You aren't seeing any errors because you are dropping the event if there is a grokparsefailure.

Comment out:

> [@](#):
>
> if "\_grokparsefailure" in [tags] {
> 
> drop { }
> 
> }

and you'll start seeing the errors.  
Then start by stepping through your match statement to figure out the right way to parse it.

This might be a good place to use the key pair plugin to reduce your effort.

> **[Kv filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html)**

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/logstash-cant-filter-syslog-from-pfsense-firewall/66404/4 "2017-07-06T04:30:25Z")

</div>