30-pfsense.conf

filter {
      #change to pfSense ip address
      if [type] == "pfsense" {
          grok {
                  add_tag => [ "firewall" ]
                  match => [ "message", "<(?<evtid>.*)>(?<datetime>(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?<prog>.*?): (?<msg>.*)" ]
              }
              mutate {
                  gsub => ["datetime","  "," "]
              }
              date {
                  match => [ "datetime", "MMM dd HH:mm:ss" ]
                  timezone => "UTC"
              }
              mutate {
                  replace => [ "message", "%{msg}" ]
              }
              mutate {
                  remove_field => [ "msg", "datetime" ]
              }
          }
          if [prog] =~ /^pf$/ {
              mutate {
                  add_tag => [ "packetfilter" ]
              }
              multiline {
                  pattern => "^\s+|^\t\s+"
                  what => "previous"
              }
              mutate {
                  remove_field => [ "msg", "datetime" ]
                  remove_tag => [ "multiline" ]
              }
              grok {
                  match => [ "message", "rule%{SPACE}(?<rule>.*)\(.*\):%{SPACE}(?<action>pass|block)%{SPACE}(?<direction>in|out)%{SPACE}on%{SPACE}(?<iface>[^:_]+)(?:_vlan%{INT:vlan})?:.*(proto|next\-header)%{SPACE} (?<proto>TCP|UDP|IGMP|ICMPv6|ICMP).*\)%{SPACE}%{IP:src_ip}\.?(?<src_port>(\d*))%{SPACE}[<|>]%{SPACE}%{IP:dest_ip}\.?(?<dest_port>(\d*)):" ]
              }
              if [src_ip] =~ /:/ {
                  mutate { add_field => { "ip_version" => "IPv6" } }
              }else{
                  mutate { add_field => { "ip_version" => "IPv4" } }
              }
              if [prog] =~ /^dhcpd$/ {
              if [message] =~ /^DHCPACK|^DHCPREQUEST|^DHCPOFFER/ {
                  grok {
                      match => [ "message", "(?<action>.*) (on|for|to) (?<src_ip>[0-2]?[0-9]?[0-9]\.[0-2]?[0-9]?[0-9]\.[0-2]?[0-9]?[0-9]\.[0-2]?[0-9]?[0-9]) .*(?<mac_address>[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]).* via (?<iface>.*)" ]
                  }
              }
              if [message] =~ /^DHCPDISCOVER/ {
                  grok {
                      match => [ "message", "(?<action>.*) from (?<mac_address>[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]).* via (?<iface>.*)" ]
                  }
              }
              if [message] =~ /^DHCPINFORM/ {
                  grok {
                      match => [ "message", "(?<action>.*) from (?<src_ip>.*).* via (?<iface>.*)" ]
                  }
              }
             } 
          geoip {
            add_tag => [ "GeoIP" ]
            source => "src_ip"
          }              
      }
}