# Logstash issue with pfSense 2.2.2 (SOLVED) **URL:** \ **Category:** Logstash\ **Created:** [August 25, 2015, 2:31am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988 "2015-08-25T02:31:09Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [August 25, 2015, 2:31am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/1 "2015-08-25T02:31:09Z")
Hi, I was wondering if someone could guide me or help me with this issue I have been having. I think i know where im wrong i just dont know what do about it. Alright So i have been following 2 guides to get my pfSense to send all the logs. I am using lbuntu for the operating system. So i did everything that the guide says and even the Kibana web interface shows up but the part im stuck is on the logstash. I think the part where im confused on the second guide is where he says i need to put this other file pfsense2-2.grok into the patterns folder but I have no idea where to add the patterns folder. And the pfsense2-2.grok [https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2](https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2) Because when i run tail -f /var/log/logstash/logstash.stdout i get an outcome of "get pattern log not defined" see pics and also im not sure why i am not getting dashboards for pfSense instead i get a kibana dashboard or a logstash dashboard > **[Monitoring logs with ELK (Logstash, Kibana, ElasticSearch), for pfsenโ€ฆ](https://archive.is/538mj#selection-517.0-517.14)** > > archived 4 Sep 2014 17:26:40 UTC [https://elijahpaul.co.uk/monitoring-pfsense-](https://elijahpaul.co.uk/monitoring-pfsense-) 2-1-logs-using-elk-logstash-kibana-elasticsearch/ Thank you [![](https://s12.postimg.org/7u9yba919/Clipboarder.2015.08.24-009.png) ](https://s12.postimg.org/7u9yba919/Clipboarder.2015.08.24-009.png) [![](https://s12.postimg.org/a7naojy2l/Clipboarder.2015.08.24-010.png) ](https://s12.postimg.org/a7naojy2l/Clipboarder.2015.08.24-010.png) [![](https://s12.postimg.org/q8khf9lbx/Clipboarder.2015.08.24-011.png) ](https://s12.postimg.org/q8khf9lbx/Clipboarder.2015.08.24-011.png) [![](https://s12.postimg.org/cq8zp8jst/Clipboarder.2015.08.24-013.png) ](https://s12.postimg.org/cq8zp8jst/Clipboarder.2015.08.24-013.png) [![](https://s12.postimg.org/qqfmv4awt/Clipboarder.2015.08.24-014.png) ](https://s12.postimg.org/qqfmv4awt/Clipboarder.2015.08.24-014.png) [![](https://s12.postimg.org/vmj9mtb25/Clipboarder.2015.08.24-015.png) ](https://s12.postimg.org/vmj9mtb25/Clipboarder.2015.08.24-015.png) [![](https://s12.postimg.org/bvr1gy1bx/Clipboarder.2015.08.24-016.png) ](https://s12.postimg.org/bvr1gy1bx/Clipboarder.2015.08.24-016.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 25, 2015, 2:40am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/2 "2015-08-25T02:40:56Z")
It's easier if you put the text stuff into gist/pastebin/etc and then link it, screenshots can be hard to read ๐Ÿ˜„ The [patterns directory](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-patterns_dir) is relative to the logstash binary. It's best if you use a full path to it to be safe. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [August 25, 2015, 3:23am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/3 "2015-08-25T03:23:02Z")
Hi Mark, Thank you for replying so quick. My apologies on github im somewhat new to this stuff ๐Ÿ˜„ Here are the paste bins. So if i understood correctly i would open putty then type `vim /opt/logstash/patterns/pfsense2-2.grok` Edit that file using this pastebin [https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2](https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2) then type `sudo service logstash restart` then i try to run `tail -f /var/log/logstash/logstash.stdout` but it gets stuck does not show error [http://s22.postimg.org/jjuhd7ikh/Clipboarder\_2015\_08\_24\_017.png](http://s22.postimg.org/jjuhd7ikh/Clipboarder_2015_08_24_017.png) โ˜น [http://pastebin.com/dtLYNiFQ](http://pastebin.com/dtLYNiFQ) 11-pfsense.config [http://pastebin.com/LJjTx6TH](http://pastebin.com/LJjTx6TH) 01-inputs.config [http://pastebin.com/KpxYkPLg](http://pastebin.com/KpxYkPLg) 10-syslog.conf Thank you ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [August 27, 2015, 12:20am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/4 "2015-08-27T00:20:20Z")
so i figured out what i did wrong for people who having trouble i will make a full tutorial on installing ELK after i get geoip working with curator on automatic deletion. What happened i had to join those 3 .conf and make it into one and call it logstash.conf and need to point my .grok files to the patterns directory on the logstash.conf ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 27, 2015, 1:06am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/5 "2015-08-27T01:06:22Z")
Sorry for not getting back to you on this. You shouldn't need to merge the files, LS does that for you at run time. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [August 27, 2015, 1:15am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/6 "2015-08-27T01:15:27Z")
no worries, thanks for replying so the way i had it worked? ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [August 27, 2015, 1:26am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/7 "2015-08-27T01:26:46Z")
yeah your completely right i just separated the files i think what i missed is to run `service logstash restart` now its working also is there way to auto start logstash when the VM restarts? Thank you ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 27, 2015, 1:29am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/8 "2015-08-27T01:29:39Z")
It should do that, but if not it depends on your OS and what manages the service. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [August 27, 2015, 2:39am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/9 "2015-08-27T02:39:51Z")
Thank you again ๐Ÿ˜„ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/logstash-issue-with-pfsense-2-2-2-solved/27988/10 "2017-07-06T05:30:48Z")