pfSense 2.6 and ELK 8.6 _grokparsefailure

[nerdy]

Hi, has anyone been successful in making pfSense 2.6 work with logstash 8.6? I using the pfELK configs and I'm getting _grokparsefailures:

      "tags" => [
    [0] "syslog",
    [1] "_grokparsefailure"

Any help is greatly appreciated.

Thanks!

[keyser]

@nerdy Consider using the pfsense Package named “SYSLOG-NG” to forward logs to ELK. There are several advantages:

1: It can monitor local files for entries and forward them to ELK. That not only means the local pfsense log files, but also package log files from pfBlockerNG, Freeradius, NtopNG and Suricata/snort.

2: Syslog-NG can speak/convert inputs to native GROK so ElasticSearch gets data in the most enriched way right up front.

It also makes is easy to filter specific log entries from the monitored logfiles that there is no need to forward and store in ELK.