fabianfrz / logstash-filter-opnsensefilter Goto Github PK

Hi,
first thanks for this logstash filter!
Because the IPv6 logs have the protocol uppercase the port extraction doesn't work, for example:

filterlog: 155,,,0,re1,match,pass,in,4,0x0,,64,0,0,DF,6,tcp,64,10.0.0.36,52.26.172.198,60465,443,0,S,2364095256,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol

filterlog: 157,,,0,re1,match,pass,in,6,0x00,0x8a4df,64,TCP,6,44,2001:123:234:25::24,2100:1450:400f:c0d::6d,60463,993,0,SEC,2945113813,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol

I'd suggest to parse the protocol case independent so OPNsense can fix the logging in the future and the filter works for both log formats.
I'd also prefer if the protocol is always returned lower- or uppercase, your choice.

Thanks!

Hi Fabian,
does this still work with the latest OPNsense 18.1.1 and ELK stack?
I've also installed your mentioned plugin "logstash-filter-opnsensefilter" and it seems to be running. Unfortunately I'm still getting "_grokparsefailure" if I try to send data to logstash

Can you give me a hint on how to debug this?

Thanks and BR from vienna ;)