OPNsense filterlog GROK patterns

opnsense-filterlog.grok

#
# OPNsense filterlog GROK patterns
# Based on: https://github.com/opnsense/ports/blob/b221352/opnsense/filterlog/files/description.txt
#
# Entrypoint: %{OPNSENSE_FILTERLOG}
#
# TODO: OPNSENSE_CARP
#
OPNSENSE_DIRECTION \bin(?:/out)?|out\b
OPNSENSE_WORD \b[\w-]+\b
OPNSENSE_FILTERLOG %{OPNSENSE_TCP}|%{OPNSENSE_UDP}|%{OPNSENSE_IPV4}|%{OPNSENSE_IPV6}
OPNSENSE_IPV4 %{OPNSENSE_PACKETFILTER},%{INT:ip_ver},%{BASE16NUM:tos},%{OPNSENSE_WORD:ecn}?,%{INT:ttl},%{INT:id},%{INT:offset},%{OPNSENSE_WORD:flags},%{INT:proto_num},%{OPNSENSE_WORD:proto},%{INT:length},%{IPV4:src},%{IPV4:dst}
OPNSENSE_IPV6 %{OPNSENSE_PACKETFILTER},%{INT:ip_ver},%{BASE16NUM:class},%{BASE16NUM:flow},%{INT:hop_limit},%{OPNSENSE_WORD:proto},%{INT:proto_num},%{INT:length},%{IPV6:src},%{IPV6:dst}
OPNSENSE_LABEL (?:\b%{OPNSENSE_WORD:label}\b|\(null\))
OPNSENSE_PACKETFILTER %{INT:rule},%{INT:subrule}?,%{INT:anchor}?,%{OPNSENSE_LABEL:label},%{OPNSENSE_WORD:interface},%{OPNSENSE_WORD:reason},%{OPNSENSE_WORD:action},%{OPNSENSE_DIRECTION:dir}
OPNSENSE_TCP (?:%{OPNSENSE_IPV4}|%{OPNSENSE_IPV6}),%{INT:src_port},%{INT:dst_port},%{INT:data_len},%{OPNSENSE_WORD:tcp_flags},(?:%{INT:tcp_seq}(?:\:\d+)?)?,%{INT:tcp_ack}?,%{INT:tcp_win},%{INT:tcp_urg}?,(?<tcp_options>[^,]+)?
OPNSENSE_UDP (?:%{OPNSENSE_IPV4}|%{OPNSENSE_IPV6}),%{INT:src_port},%{INT:dst_port},%{INT:data_len}