What would be the most efficient way of parsing pfSense 2.2 logs' new format? Regex, CSV or some other way?

[Biggsy]

Hi,

I've been using Splunk for a while but only in a very basic way, by monitoring my Kiwi syslog files.

pfSense 2.2 is currently in release candidate stage and a new log format has been introduced with this version. Among other things, this avoids the multi-line syslog problems documented elsewhere in Splunk>answers.

The documentation about the new log format is located here:
https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2

Firstly, what would be the most efficient way of parsing these logs in Splunk? With regex, as CSV or some other way?

It also seems that, depending on the value of one field, the following fields will vary. How is it possible to take that into account during the parsing?

Any help very much appreciated. Thanks.

[amiracle]

I ended up using REGEX to parse the logs since it has different fields depending on the type of protocol (TCP, UDP, etc.) I can share with you what I did to parse the pfsense logs in my Home Monitor App for Splunk.