How to create a table for pfsense firewall logs using rex command?

[jawadak]

I was trying to create a table for pfsense firewall logs using rex command. But it is not creating a table, instead showing the raw logs.

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?[0-9A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?[A-Za-z0-9]),[0-9],(?[A-Za-z0-9.:]),(?[A-Za-z0-9.:]),(?[0-9]),(?[0-9]*)"

Can anyone point the error in the above command?

[TISKAR · Accepted solution]

@jawadak, can you try by this:

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*

If that not work can you please share the exampleof one event to test.

Regards

[jawadak]

Thanks, it worked

[somesoni2]

The rex command just extracts fields from raw data, doesn't show in tabular format. You should be able to see the fields (if extraction is correct) on the field sidebar on the left. You'd need to specify a table command explicitly, with the fields that you want, to view a tabular output.