Pattern %{PFSENSE_LOG_DATA} not defined about logstash-pfsense

[matthew-williams]

testinglogstash.log
This loops over and over in logstash.

[matthew-williams]

RESOLVED

filter {
  if "PFSense" in [tags] {
    grok {
      add_tag => [ "firewall" ]
      match => [ "message", "<(?<evtid>.*)>(?<datetime>(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec($
    }
    mutate {
      gsub => ["datetime","  "," "]
    }
    date {
      match => [ "datetime", "MMM dd HH:mm:ss" ]
      timezone => "America/New_York"
    }
    mutate {
      replace => [ "message", "%{msg}" ]
    }
    mutate {
      remove_field => [ "msg", "datetime" ]
    }
    if [prog] =~ /^filterlog$/ {
      mutate {
        remove_field => [ "msg", "datetime" ]
      }
      grok {
        patterns_dir => "/etc/logstash/conf.d/patterns"
        match => [ "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IP_SPECIFIC_DATA}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}",
           "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IPv4_SPECIFIC_DATA_ECN}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}" ]
      }
      mutate {
        lowercase => [ 'proto' ]
      }
      geoip {
        add_tag => [ "GeoIP" ]
        source => "src_ip"
      }
    }
  }
}

Changed pfsense.conf in /etc/logstash/conf.d/ to the correct pattern directory:

patterns_dir => "/etc/logstash/conf.d/patterns"