Logstash - tagging snort[#####] not working


(Kozoke) #1

Hi,

I'm attempting to extract pfsense logs, specifically the snort plugin alert logs.

I've pulled the following filter from this site:
https://gist.githubusercontent.com/mrlesmithjr/0799cdc3710f2ae1e182/raw/cfad5b0740928060b9322fcc5a4406073cc446ce/pfsense_snort_logstash

My filter is this:
if [prog] == /snort$ / {
mutate {
add_tag => [ "snort" ]
}
}

Logstash shows this as the [prog] field - so it is parsing this out (which is snort[pid]:
snort[59585]

Question is - how can I tag this text snort[#####]
so the rest of the filter works?

I'm guessing my filter match is incorrect?

Thanks!

Full unfiltered sample log below.
```<33>Dec 3 18:59:27 snort[38444]: [1:2402000:5016] ET DROP Dshield Preformatted Block Listed Source group 1 [Classification: Misc Attack] [Priority: 2] {TCP}Preformatted ###.###.###.###: -> ###.###.###.###: