[pfsense]: Grok parse failure for firewall logs with match action.

### Integration Name

pfSense [pfsense]

### Dataset Name

pfsense.log

### Integration Version

1.23.1

### Agent Version

9.1.0

### Agent Output Type

logstash

### Elasticsearch Version

9.1.0

### OS Version and Architecture

Debian12

### Software/API Version

_No response_

### Error Message

Provided Grok expressions do not match field value: [155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,29785,0,none,17,udp,81,192.168.1.1,149.112.112.112,52819,53,61]

### Event Original

<134>1 2025-09-09T09:50:55.089267+00:00 FW01.foo.bar filterlog 15508 - - 155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65

### What did you do?

To fix I've changed Grok in pipeline logs-pfsense.log-1.23.1-firewall
From
"PF_LOG_DATA": "%{INT},%{INT}?,,%{WORD:rule.id},%{DATA:observer.ingress.interface.name},%{PF_REASON:event.reason},%{WORD:event.action},%{WORD:network.direction},",
To
PF_LOG_DATA %{INT},%{INT}?,,%{WORD:rule.id},%{DATA:observer.ingress.interface.name},%{PF_REASON:event.reason},%{DATA:event.action},%{WORD:network.direction},

### What did you see?

```
{
"_index": ".ds-logs-pfsense.log-default-2025.09.06-000021",
"_id": "lXviLZkBZxNaSkjNtiWe",
"_version": 1,
"_source": {
"agent": {
"name": "syslog01",
"id": "55f6e486-a913-439b-9759-7e1fa8528415",
"ephemeral_id": "b124f889-1c37-4616-a315-8004580bfa9f",
"type": "filebeat",
"version": "9.1.0"
},
"process": {
"name": "filterlog",
"pid": 15508
},
"log": {
"logger": "SYSLOG02",
"source": {
"address": "192.168.1.2:514"
},
"syslog": {
"priority": 134
}
},
"elastic_agent": {
"id": "55f6e486-a913-439b-9759-7e1fa8528415",
"version": "9.1.0",
"snapshot": false
},
"destination": {
"geo": {
"continent_name": "North America",
"region_iso_code": "US-CA",
"city_name": "Berkeley",
"country_iso_code": "US",
"country_name": "United States",
"region_name": "California",
"location": {
"lat": 37.8767,
"lon": -122.2676
}
},
"as": {
"number": 19281,
"organization": {
"name": "QUAD9-AS-1"
}
},
"address": "9.9.9.9",
"port": 53,
"ip": "9.9.9.9"
},
"rule": {
"id": "1757403802"
},
"source": {
"address": "192.168.1.1",
"port": 49801,
"ip": "192.168.1.1",
"network": {
"name": "foobar",
"range": "192.168.0.0/16"
}
},
"message": "155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65",
"tags": [
"preserve_original_event",
"pfsense",
"forwarded",
"beats_input_codec_plain_applied"
],
"network": {
"community_id": "1:yDoqXDbQrNfAY/rR9rwe2baLsKE=",
"vlan": {
"id": "3"
},
"bytes": 85,
"transport": "udp",
"type": "ipv4",
"iana_number": "17",
"direction": "inbound"
},
"input": {
"type": "udp"
},
"observer": {
"ingress": {
"vlan": {
"id": "3"
},
"interface": {
"name": "lagg0.3"
}
},
"vendor": "netgate",
"name": "FW01.foo.bar",
"type": "firewall"
},
"@timestamp": "2025-09-09T09:50:55.089Z",
"ecs": {
"version": "8.17.0"
},
"pfsense": {
"udp": {
"length": 65
},
"ip": {
"offset": 0,
"flags": "none",
"tos": "0x0",
"id": 9568,
"ttl": 64
}
},
"related": {
"ip": [
"9.9.9.9",
"192.168.1.1"
]
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "pfsense.log"
},
"@version": "1",
"event": {
"agent_id_status": "auth_metadata_missing",
"reason": "match",
"ingested": "2025-09-09T09:50:56Z",
"provider": "filterlog",
"timezone": "+00:00",
"kind": "event",
"action": "unkn(%u)",
"type": [
"connection"
],
"category": [
"network"
],
"dataset": "pfsense.log"
}
},
"fields": {
"rule.id": [
"1757403802"
],
"elastic_agent.version": [
"9.1.0"
],
"event.category": [
"network"
],
"process.name.text": [
"filterlog"
],
"observer.ingress.interface.name": [
"lagg0.3"
],
"process.pid": [
15508
],
"observer.vendor": [
"netgate"
],
"agent.name.text": [
"syslog01"
],
"event.reason": [
"match"
],
"destination.geo.region_name": [
"California"
],
"source.ip": [
"172.26.103.30"
],
"agent.name": [
"syslog01"
],
"destination.address": [
"9.9.9.9"
],
"network.community_id": [
"1:yDoqXDbQrNfAY/rR9rwe2baLsKE="
],
"event.agent_id_status": [
"auth_metadata_missing"
],
"event.kind": [
"event"
],
"observer.ingress.vlan.id": [
"3"
],
"event.original": [
"<134>1 2025-09-09T09:50:55.089267+00:00 FW01.foo.bar filterlog 15508 - - 155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65"
],
"destination.geo.continent_name": [
"North America"
],
"input.type": [
"udp"
],
"data_stream.type": [
"logs"
],
"tags": [
"preserve_original_event",
"pfsense",
"forwarded",
"beats_input_codec_plain_applied"
],
"process.name": [
"filterlog"
],
"destination.geo.city_name": [
"Berkeley"
],
"event.provider": [
"filterlog"
],
"agent.id": [
"55f6e486-a913-439b-9759-7e1fa8528415"
],
"source.port": [
49801
],
"ecs.version": [
"8.17.0"
],
"observer.type": [
"firewall"
],
"log.source.address": [
"192.168.1.1:514"
],
"network.iana_number": [
"17"
],
"agent.version": [
"9.1.0"
],
"destination.geo.country_name": [
"United States"
],
"destination.geo.region_iso_code": [
"US-CA"
],
"destination.port": [
53
],
"pfsense.udp.length": [
65
],
"observer.name": [
"FW01.sbgservices.eu"
],
"source.address": [
"192.168.1.1"
],
"source.network.name.text": [
"Augustinergasse"
],
"log.logger": [
"SYSLOG02"
],
"destination.geo.location": [
{
"coordinates": [
-122.2676,
37.8767
],
"type": "Point"
}
],
"agent.type": [
"filebeat"
],
"event.module": [
"pfsense"
],
"related.ip": [
"9.9.9.9",
"192.168.1.1"
],
"source.network.name": [
"foobar"
],
"@version": [
"1"
],
"network.bytes": [
85
],
"elastic_agent.snapshot": [
false
],
"network.vlan.id": [
"3"
],
"log.syslog.priority": [
134
],
"network.direction": [
"inbound"
],
"event.timezone": [
"+00:00"
],
"network.type": [
"ipv4"
],
"pfsense.ip.id": [
9568
],
"elastic_agent.id": [
"55f6e486-a913-439b-9759-7e1fa8528415"
],
"data_stream.namespace": [
"default"
],
"destination.as.number": [
19281
],
"source.network.range": [
"172.26.0.0/16"
],
"destination.as.organization.name.text": [
"QUAD9-AS-1"
],
"message": [
"155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65"
],
"destination.ip": [
"9.9.9.9"
],
"network.transport": [
"udp"
],
"pfsense.ip.ttl": [
64
],
"event.action": [
"unkn(%u)"
],
"event.ingested": [
"2025-09-09T09:50:56.000Z"
],
"@timestamp": [
"2025-09-09T09:50:55.089Z"
],
"pfsense.ip.tos": [
"0x0"
],
"destination.geo.country_iso_code": [
"US"
],
"pfsense.ip.offset": [
0
],
"data_stream.dataset": [
"pfsense.log"
],
"event.type": [
"connection"
],
"agent.ephemeral_id": [
"b124f889-1c37-4616-a315-8004580bfa9f"
],
"pfsense.ip.flags": [
"none"
],
"event.dataset": [
"pfsense.log"
],
"destination.as.organization.name": [
"QUAD9-AS-1"
]
}

```}

### What did you expect to see?

`{
"_index": ".ds-logs-pfsense.log-default-2025.09.06-000021",
"_id": "lXviLZkBZxNaSkjNtiWe",
"_version": 1,
"_source": {
"agent": {
"name": "syslog01",
"id": "55f6e486-a913-439b-9759-7e1fa8528415",
"ephemeral_id": "b124f889-1c37-4616-a315-8004580bfa9f",
"type": "filebeat",
"version": "9.1.0"
},
"process": {
"name": "filterlog",
"pid": 15508
},
"log": {
"logger": "SYSLOG02",
"source": {
"address": "192.168.1.2:514"
},
"syslog": {
"priority": 134
}
},
"elastic_agent": {
"id": "55f6e486-a913-439b-9759-7e1fa8528415",
"version": "9.1.0",
"snapshot": false
},
"destination": {
"geo": {
"continent_name": "North America",
"region_iso_code": "US-CA",
"city_name": "Berkeley",
"country_iso_code": "US",
"country_name": "United States",
"region_name": "California",
"location": {
"lat": 37.8767,
"lon": -122.2676
}
},
"as": {
"number": 19281,
"organization": {
"name": "QUAD9-AS-1"
}
},
"address": "9.9.9.9",
"port": 53,
"ip": "9.9.9.9"
},
"rule": {
"id": "1757403802"
},
"source": {
"address": "192.168.1.1",
"port": 49801,
"ip": "192.168.1.1",
"network": {
"name": "foobar",
"range": "192.168.0.0/16"
}
},
"message": "155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65",
"tags": [
"preserve_original_event",
"pfsense",
"forwarded",
"beats_input_codec_plain_applied"
],
"network": {
"community_id": "1:yDoqXDbQrNfAY/rR9rwe2baLsKE=",
"vlan": {
"id": "3"
},
"bytes": 85,
"transport": "udp",
"type": "ipv4",
"iana_number": "17",
"direction": "inbound"
},
"input": {
"type": "udp"
},
"observer": {
"ingress": {
"vlan": {
"id": "3"
},
"interface": {
"name": "lagg0.3"
}
},
"vendor": "netgate",
"name": "FW01.foo.bar",
"type": "firewall"
},
"@timestamp": "2025-09-09T09:50:55.089Z",
"ecs": {
"version": "8.17.0"
},
"pfsense": {
"udp": {
"length": 65
},
"ip": {
"offset": 0,
"flags": "none",
"tos": "0x0",
"id": 9568,
"ttl": 64
}
},
"related": {
"ip": [
"9.9.9.9",
"192.168.1.1"
]
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "pfsense.log"
},
"@version": "1",
"event": {
"agent_id_status": "auth_metadata_missing",
"reason": "match",
"ingested": "2025-09-09T09:50:56Z",
"provider": "filterlog",
"timezone": "+00:00",
"kind": "event",
"action": "unkn(%u)",
"type": [
"connection"
],
"category": [
"network"
],
"dataset": "pfsense.log"
}
},
"fields": {
"rule.id": [
"1757403802"
],
"elastic_agent.version": [
"9.1.0"
],
"event.category": [
"network"
],
"process.name.text": [
"filterlog"
],
"observer.ingress.interface.name": [
"lagg0.3"
],
"process.pid": [
15508
],
"observer.vendor": [
"netgate"
],
"agent.name.text": [
"syslog01"
],
"event.reason": [
"match"
],
"destination.geo.region_name": [
"California"
],
"source.ip": [
"172.26.103.30"
],
"agent.name": [
"syslog01"
],
"destination.address": [
"9.9.9.9"
],
"network.community_id": [
"1:yDoqXDbQrNfAY/rR9rwe2baLsKE="
],
"event.agent_id_status": [
"auth_metadata_missing"
],
"event.kind": [
"event"
],
"observer.ingress.vlan.id": [
"3"
],
"event.original": [
"<134>1 2025-09-09T09:50:55.089267+00:00 FW01.foo.bar filterlog 15508 - - 155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65"
],
"destination.geo.continent_name": [
"North America"
],
"input.type": [
"udp"
],
"data_stream.type": [
"logs"
],
"tags": [
"preserve_original_event",
"pfsense",
"forwarded",
"beats_input_codec_plain_applied"
],
"process.name": [
"filterlog"
],
"destination.geo.city_name": [
"Berkeley"
],
"event.provider": [
"filterlog"
],
"agent.id": [
"55f6e486-a913-439b-9759-7e1fa8528415"
],
"source.port": [
49801
],
"ecs.version": [
"8.17.0"
],
"observer.type": [
"firewall"
],
"log.source.address": [
"192.168.1.1:514"
],
"network.iana_number": [
"17"
],
"agent.version": [
"9.1.0"
],
"destination.geo.country_name": [
"United States"
],
"destination.geo.region_iso_code": [
"US-CA"
],
"destination.port": [
53
],
"pfsense.udp.length": [
65
],
"observer.name": [
"FW01.sbgservices.eu"
],
"source.address": [
"192.168.1.1"
],
"source.network.name.text": [
"Augustinergasse"
],
"log.logger": [
"SYSLOG02"
],
"destination.geo.location": [
{
"coordinates": [
-122.2676,
37.8767
],
"type": "Point"
}
],
"agent.type": [
"filebeat"
],
"event.module": [
"pfsense"
],
"related.ip": [
"9.9.9.9",
"192.168.1.1"
],
"source.network.name": [
"foobar"
],
"@version": [
"1"
],
"network.bytes": [
85
],
"elastic_agent.snapshot": [
false
],
"network.vlan.id": [
"3"
],
"log.syslog.priority": [
134
],
"network.direction": [
"inbound"
],
"event.timezone": [
"+00:00"
],
"network.type": [
"ipv4"
],
"pfsense.ip.id": [
9568
],
"elastic_agent.id": [
"55f6e486-a913-439b-9759-7e1fa8528415"
],
"data_stream.namespace": [
"default"
],
"destination.as.number": [
19281
],
"source.network.range": [
"172.26.0.0/16"
],
"destination.as.organization.name.text": [
"QUAD9-AS-1"
],
"message": [
"155,,,1757403802,lagg0.3,match,unkn(%u),in,4,0x0,,64,9568,0,none,17,udp,85,192.168.1.1,9.9.9.9,49801,53,65"
],
"destination.ip": [
"9.9.9.9"
],
"network.transport": [
"udp"
],
"pfsense.ip.ttl": [
64
],
"event.action": [
"unkn(%u)"
],
"event.ingested": [
"2025-09-09T09:50:56.000Z"
],
"@timestamp": [
"2025-09-09T09:50:55.089Z"
],
"pfsense.ip.tos": [
"0x0"
],
"destination.geo.country_iso_code": [
"US"
],
"pfsense.ip.offset": [
0
],
"data_stream.dataset": [
"pfsense.log"
],
"event.type": [
"connection"
],
"agent.ephemeral_id": [
"b124f889-1c37-4616-a315-8004580bfa9f"
],
"pfsense.ip.flags": [
"none"
],
"event.dataset": [
"pfsense.log"
],
"destination.as.organization.name": [
"QUAD9-AS-1"
]
}
}`

### Anything else?

On pfsense firewall you can set firewall rule to action match(used for debugging or traffic shaping)
These logs are not parsed by pipeline logs-pfsense.log-1.23.1-firewall
to fix %{WORD:event.action} needs to be changed to it matches "unkn(%u)" for example to %{DATA:event.action}