Adding into the thread as I am too having issues similar as reported. I was at one point processing logs and extracting fields as expected, however, stopped a few days ago. In outside tutorials and posts, I noted the timestamp listed in the logs is much different thank what I am seeing. Some sites show timestamp as: MMM d HH:MM:SS filterlog: {etc} However, my installation is producing logs in the following format: 1 YYYY-MM-DDTHH:MM:SS.084257+00:00 {pfSense DNS name} filterlog {etc} Following recommendations from other posts, it seemed the transforms.conf regular expression did not take into account this detailed timestamp. I updated as follows and I am now extracting accurate source types but still working to get fields properly extracted through editing props.conf. \w{1}\s\w{4}-\w{1,2}-\w{1,2}T\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,6}\+\d{1,2}:\d{1,2}\s(?:[\w.]+\s)?(\w+) I will post a follow up once I make more progress.
... View more
