# Pfsense 2.4 logs to logstash error
**URL:** https://discuss.elastic.co/t/pfsense-2-4-logs-to-logstash-error/128194
**Category:** Logstash
**Created:** [April 16, 2018, 1:25pm UTC](https://discuss.elastic.co/t/pfsense-2-4-logs-to-logstash-error/128194 "2018-04-16T13:25:39Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@francescouk](https://discuss.elastic.co/u/francescouk)
#### Post date: [April 16, 2018, 1:25pm UTC](https://discuss.elastic.co/t/pfsense-2-4-logs-to-logstash-error/128194/1 "2018-04-16T13:25:40Z")
Hi,
I´m trying to send pfsense logs to logstash but keep´s giving me error \_geoip\_lookup\_failure and \_grokparsefailure.
Because I´m newbie to this scene, I was using this conf from web and it was working until upgrade stack package. But now, I don´t even know where to start. So I deeply ask for help. At least, where to start.
Here´s the output:
"evtid" =\> "134",
"@timestamp" =\> 2018-04-16T12:44:53.000Z,
"@version" =\> "1",
"prog" =\> "filterlog",
"type" =\> "syslog"
}
{
"message" =\> "121,,,1506957320,bge0,match,pass,in,4,0x0,,128,3213,0,DF,6,tcp,52,192.168.225.127,23.21.68.3,49988,443,0,S,1366643320,,65535,,mss;nop;wscale;nop;nop;sackOK",
"tags" =\> [
[0] "PFSense",
[1] "firewall",
[2] "\_geoip\_lookup\_failure"
],
"proto" =\> "tcp",
"flags" =\> "DF",
"tos" =\> "0x0",
"host" =\> "192.168.78.50",
"ip\_ver" =\> "4",
"evtid" =\> "134",
"dest\_port" =\> "443",
"direction" =\> "in",
"id" =\> "3213",
"data\_length" =\> "0",
"@version" =\> "1",
"action" =\> "pass",
"ttl" =\> "128",
"proto\_id" =\> "6",
"src\_ip" =\> "192.168.225.127",
"length" =\> "52",
"@timestamp" =\> 2018-04-16T12:44:53.000Z,
"rule" =\> "121",
"dest\_ip" =\> "23.21.68.3",
"geoip" =\> {},
"prog" =\> "filterlog",
"type" =\> "syslog",
"src\_port" =\> "49988",
"offset" =\> "0",
"iface" =\> "bge0",
"reason" =\> "match",
"tracker" =\> "1506957320"
}
{
"message" =\> "7,,,1000000105,bge0,match,block,in,6,0x00,0x00000,1,UDP,17,513,fe80::1166:a6b6:4b4b:254,ff02::c,1900,1900,513",
"host" =\> "192.168.224.18",
"tags" =\> [
[0] "PFSense",
[1] "firewall",
[2] "\_grokparsefailure",
[3] "\_geoip\_lookup\_failure"
],
"evtid" =\> "134",
"@timestamp" =\> 2018-04-16T12:44:53.000Z,
"@version" =\> "1",
"prog" =\> "filterlog",
"type" =\> "syslog"
}
{
"message" =\> "121,,,1506957320,bge0,match,pass,in,4,0x0,,128,3213,0,DF,6,tcp,52,192.168.225.127,23.21.68.3,49988,443,0,S,1366643320,,65535,,mss;nop;wscale;nop;nop;sackOK",
"tags" =\> [
[0] "PFSense",
[1] "firewall",
[2] "\_geoip\_lookup\_failure"
],
###########################################################################
01-inputs.conf
#tcp syslog stream via 5140
input {
tcp {
type =\> "syslog"
port =\> 5140
}
}
#udp syslogs stream via 5140
input {
udp {
type =\> "syslog"
port =\> 5140
}
}
10-syslog.conf
filter {
if [type] == "syslog" {
#change to pfSense ip address
if [host] =~ /192.168.78.50/ {
mutate {
add\_tag =\> ["PFSense", "Ready"]
}
}
if "Ready" not in [tags] {
mutate {
add\_tag =\> ["syslog"]
}
}
}
}
filter {
if [type] == "syslog" {
mutate {
remove\_tag =\> "Ready"
}
}
}
filter {
if "syslog" in [tags] {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
locale =\> "en"
}
if !("\_grokparsefailure" in [tags]) {
mutate {
replace =\> ["@source\_host", "%{syslog\_hostname}"]
replace =\> ["@message", "%{syslog\_message}"]
}
}
mutate {
remove\_field =\> ["syslog\_hostname", "syslog\_message", "syslog\_timestamp"]
}
# if "\_grokparsefailure" in [tags] {
# drop { }
# }
}
}
11-pfsense.conf
filter {
if "PFSense" in [tags] {
grok {
add\_tag =\> ["firewall"]
match =\> ["message", "\<(?._)\>(?(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?._?): (?.\*)" ]
}
mutate {
gsub =\> ["datetime"," "," "]
}
date {
match =\> ["datetime", "MMM dd HH:mm:ss"]
timezone =\> "America/Sao\_Paulo"
}
mutate {
replace =\> ["message", "%{msg}"]
}
mutate {
remove\_field =\> ["msg", "datetime"]
}
}
if [prog] =~ /^filterlog$/ {
mutate {
remove\_field =\> ["msg", "datetime"]
}
grok {
patterns\_dir =\> "/etc/logstash/conf.d/patterns"
match =\> [ "message", "%{PFSENSE\_LOG\_DATA}%{PFSENSE\_IP\_SPECIFIC\_DATA}%{PFSENSE\_IP\_DATA}%{PFSENSE\_PROTOCOL\_DATA}",
"message", "%{PFSENSE\_LOG\_DATA}%{PFSENSE\_IPv4\_SPECIFIC\_DATA\_ECN}%{PFSENSE\_IP\_DATA}%{PFSENSE\_PROTOCOL\_DATA}",
"message", "%{PFSENSE\_LOG\_DATA}%{PFSENSE\_IPv6\_SPECIFIC\_DATA}"]
}
mutate {
lowercase =\> ['proto']
}
geoip {
add\_tag =\> ["GeoIP"]
source =\> "src\_ip"
# Optional GeoIP database
# Comment out the below if you do not wise to utilize and omit last three steps dealing with (recommended) suffix
database =\> "/etc/logstash/GeoLite2-City.mmdb"
}
}
}
30-outputs.conf
output {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "logstash-%{+YYYY.ww}" }
# stdout { codec =\> rubydebug }
}
Thanks in advance for any help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2018, 1:26pm UTC](https://discuss.elastic.co/t/pfsense-2-4-logs-to-logstash-error/128194/2 "2018-05-14T13:26:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.