GRAYLOG_pfSense_Extractors.json

{
  "extractors": [
     {
      "title": "pfSense Firewall WebFilter Log",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{DATA:process}: %{DATA:ruleId},%{DATA:subruleId},%{DATA:anchor},%{BASE10NUM:tracker},%{DATA:sinterface},%{DATA:objectname},%{DATA:command},%{DATA:direction},%{BASE10NUM:iptype},%{DATA:offset},%{DATA:tos},%{DATA:ecn},%{BASE10NUM:duration},%{BASE10NUM:session},%{DATA:flags},%{BASE10NUM:protnum},%{DATA:protocol},%{BASE10NUM:size},%{IPV4:sip},%{IPV4:dip},%{BASE10NUM:tcp_flags},%{BASE10NUM:sequence},%{BASE10NUM:ack}"
      },
      "condition_type": "string",
      "condition_value": "filterlog:"
    }
  ],
  "version": "2.2.0-SNAPSHOT"
}