Firewall dashboard issue - "Adjust autocomplete settings in kibana.yml" - "Network trasport field missing in *-pfelk-firewall*" - "20-interfaces.pfelk did not apply the aliases" about pfelk HOT 3 CLOSED

Glad to hear.

1. OpenVPN has been a long overdue item and is listed within this project. The piece I'm struggling with is the output format of OpenVPN which is unfortunately a bit messy (too many variations) coupled with the lack of time to dedicate. I'll get to it eventually...

2. Feel free to close this issue out and open another for the Kibana Autocomplete...I'll look into that one as well.

from pfelk.

1. 20-interfaces.pfelk

• The issue regarding the 20-interfaces.pfelk
  • The referenced file is outdated and references the host by [host][name] updating will spend that field to read [log][syslog][hostname]
  • The initial filer (01-inputs.pfelk) enriches the syslog message via the pfelk.grok pattern
    • pfelk.grok pattern: [event][created], [log][syslog][hostname], [log][syslog][appname], and [log][syslog][procid] are created.
  • The 20-interfaces.pfelk (optional) adds additional fields based on the [log][syslog][hostname] field value but requires minor configuration (e.g., [log][syslog][hostname] and [interface][name])

2. Network Transport

• More context is needed...the [network][transport] is utilized within the pfelk.grok pattern file but is associated to Snort, Suricate, OpenVPN and the depreciated PF Grok patterns for which (02-firewall.pfelk) filters based on comma (structured PF logging).

from pfelk.

Thanks a lot helping me with that, actually what i did is replaced the [host][name] for [log][syslog][hostname] and everything started to work with 20-interfaces.pfelk, the rest additional fields are parsed.

Regarding [network][transport] i've replaced the field with [network][protocol] and is enough for me to have separated protocols as output.

I'm not using Snort and Suticata, well and OpnVPN is another part of what i would have fixed :) Have seen ad add a comment to closed issue, where you've been trying to fix with no luck.
There is a comment from my in that issue, so would appreciate to continue with that if you do not mind, OpenVPN is a often used protocol and regarding the right logging would be nice to have it on.

As you're not interacting with the Kibana autocomplete issue i understand that it just not belong here, just thought you've been dealing with that too, if not just forget about it.

Thanks again for your participation @613377

from pfelk.