Solved: SNORT[#####] grock'd

[kozokeith]

Re: Kibana+Elasticsearch+Logstash [ELK] v6.3.0 pfSense v2.4.3p1 and Suricata using docker-compose | docker for windows

I figured it out.
Here is the match pattern:

            if "snort" in [prog] {             
              mutate {
                add_tag => [ "snort" ]
              }
            }

Here is the grok pattern if anyone is interested.

      grok {
        match => [
          "message",  "[%{INT:ids_gid}:%{INT:ids_sid}:%{INT:ids_rev}]%{DATA:preprocessor}%{GREEDYDATA:ids_alert}.[Classification\:%{DATA:ids_classification}].*[Priority\: %{INT:ids_priority}].*{%{WORD:ids_proto}}.*%{IP:src_ip}:%{INT:src_port} \-\>.*%{IP:dst_ip}:%{INT:dst_port}",
          "message", "[%{INT:ids_gid}:%{INT:ids_sid}:%{INT:ids_rev}].%{GREEDYDATA:message2}"
        ]
      }