# Logstash Conf OpenVPN

**URL:** <https://discuss.elastic.co/t/logstash-conf-openvpn/54097>\
**Category:** Logstash\
**Created:** [June 28, 2016, 3:50am UTC](https://discuss.elastic.co/t/logstash-conf-openvpn/54097 "2016-06-28T03:50:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\
**Post date:** [June 28, 2016, 3:50am UTC](https://discuss.elastic.co/t/logstash-conf-openvpn/54097/1 "2016-06-28T03:50:49Z")

</div>

Hi,  
I was want to say that im close to logstash grok patterns for OpenVPN pfSense Logs.

I just have one tiny issue I cannot get or understand why maybe im missing a } not sure.

So after implementing the OpenVPN paterns it works perfect but then my GeoIP stops working. not sure why, as you can see the RAW data stops showing the patterns while on the RAW data without OpenVPN shows the GeoIP not sure what I missed

Thank you

Logstash conf with OpenVPN----- [http://pastebin.com/QpnEM2Bs](http://pastebin.com/QpnEM2Bs)  
Logstash conf WITHOUT OpenVPN----- [http://pastebin.com/PjpqGUAX](http://pastebin.com/PjpqGUAX)

Raw data with OpenVPN---- [http://pastebin.com/wedNp5Wt](http://pastebin.com/wedNp5Wt)

Raw data WITHOUT OpenVPN----- [http://pastebin.com/iLvkkdw8](http://pastebin.com/iLvkkdw8)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 29, 2016, 12:47am UTC](https://discuss.elastic.co/t/logstash-conf-openvpn/54097/2 "2016-06-29T00:47:29Z")

</div>

> [@killmasta93](#):
>
> So after implementing the OpenVPN paterns it works perfect but then my GeoIP stops working

What do you mean by this exactly?

---

<div class="post-metadata">

**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\
**Post date:** [June 29, 2016, 3:19am UTC](https://discuss.elastic.co/t/logstash-conf-openvpn/54097/3 "2016-06-29T03:19:43Z")

</div>

Thank you for the reply,

Sorry for not being clear

The logstash Config with the OpenVPN grok patterns are working but somehow its ignoring the GeoIP filters if you see in the examples of the RAW data.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/logstash-conf-openvpn/54097/4 "2017-07-06T04:50:35Z")

</div>