Decoding the Syslog Firewall Line

[wiz561]

I am starting to send my firewall logs to a syslog server (splunk) and bring them into it.  When looking at the line, I was wondering if anybody had a meaning of each column.  For example…

May 28 10:08:05 10.0.110.1 May 28 10:08:05 filterlog: 126,16777216,,0,vmx0,match,block,in,4,0x20,,47,14551,0,DF,6,tcp,52,<src ip="">,<dst ip="">,3228,23,0,S,1544514489,,7300,,mss;sackOK;wscale;eol</dst></src>

Month | Day | Time | Syslog Source IP | Monday | Date | Time | Source | Something | Something | ,, | Something | NIC | match | action | direction | tcp flag? | something | something | tcp flag? | something | protocol | something | source IP | destination IP | something | something | something | TCP syn |…..etc.

Some things I know, but others I don't.  Thanks in advanced.

[BBcan177]

https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2