For anyone looking to ship pfSense firewall logs to Elastic Cloud,
our solution was:
- pfSense UI - send logs to intermediate Linux host via UDP port 9100
- Linux host - install Elastic Agent
- Elastic Cloud - Add pfSense integration to Agent policy
followed this guide:
Quick start: Get logs, metrics, and uptime data into the Elastic Stack | Fleet and Elastic Agent Guide [7.15] | Elastic