# Receive logs from Pfsense but noting show in charts

**URL:** <https://discuss.elastic.co/t/receive-logs-from-pfsense-but-noting-show-in-charts/27939>\
**Category:** Logstash\
**Created:** [August 24, 2015, 11:19am UTC](https://discuss.elastic.co/t/receive-logs-from-pfsense-but-noting-show-in-charts/27939 "2015-08-24T11:19:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mega\_robo](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@mega\_robo](https://discuss.elastic.co/u/mega_robo)\
**Post date:** [August 24, 2015, 11:19am UTC](https://discuss.elastic.co/t/receive-logs-from-pfsense-but-noting-show-in-charts/27939/1 "2015-08-24T11:19:11Z")

</div>

hi every one  
i install ELK with elasticsearch and logstash 1.5 and kibana 3 and use pfsense 2.2.3 its work correctly and send logst to logstash and i can see logs in kibana and in /var/log/logstash/logstash.stutd but i created dashbourd and data can not set in this chart and i think data format not correctly

```
<134>Aug 24 13:43:16 filterlog: 75,16777216,,1000007870,em0,match,block,in,4,0x0,,128,5277,0,none,17,udp,78,X.X.X.X,1X.X.X.X,137,137,58

```

how can i fix it  
log come to my logstash but its not completely and organized parsed and they are not correct for logstash and kibana  
i hope can explain my problem

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2015, 11:28am UTC](https://discuss.elastic.co/t/receive-logs-from-pfsense-but-noting-show-in-charts/27939/2 "2015-08-24T11:28:17Z")

</div>

What does your Logstash configuration look like?

---

<div class="post-metadata">

**Author:** ![mega\_robo](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@mega\_robo](https://discuss.elastic.co/u/mega_robo)\
**Post date:** [August 24, 2015, 11:43am UTC](https://discuss.elastic.co/t/receive-logs-from-pfsense-but-noting-show-in-charts/27939/3 "2015-08-24T11:43:08Z")

</div>

input {  
tcp {  
type =\> syslog  
port =\> 5025  
}  
udp {  
type =\> syslog  
port =\> 5025  
}  
}  
filter {  
if "PFSense" in [tags] {  
grok {  
add\_tag =\> ["firewall"]  
match =\> ["message", "\<(?._)\>(?(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?._?): (?.\*)" ]  
}  
mutate {  
gsub =\> ["datetime"," "," "]  
}  
date {  
match =\> ["datetime", "MMM dd HH:mm:ss"]  
}  
mutate {  
replace =\> ["message", "%{msg}"]  
}  
mutate {  
remove\_field =\> ["msg", "datetime"]  
}  
}  
if [prog] =~ /^filterlog$/ {  
mutate {  
remove\_field =\> ["msg", "datetime"]  
}  
grok {  
patterns\_dir =\> "/etc/logstash/patterns"  
match =\> [ "message", "%{LOG\_DATA}%  
{IP\_SPECIFIC\_DATA}%  
{IP\_DATA}%  
{PROTOCOL\_DATA}" ]  
}  
mutate {  
lowercase =\> ['proto']  
}  
geoip {  
add\_tag =\> ["GeoIP"]  
source =\> "src\_ip"  
}  
}  
}  
output {

elasticsearch { host =\> localhost }  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/receive-logs-from-pfsense-but-noting-show-in-charts/27939/4 "2017-07-06T05:31:08Z")

</div>