<system>
  log_level trace
</system>

<source>
  @type syslog
  port 5141
  bind 0.0.0.0
  <transport udp>
  </transport>
  <parse>
    message_format rfc5424
  </parse>
  tag pfsense
</source>

<match pfsense.**>
  @type rewrite_tag_filter
  <rule>
    key ident
    pattern ^(.+)$
    tag pf.$1
  </rule>
</match>

<filter pf.filterlog>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version
    parser_type fast
  </parse>
</filter>

<match pf.filterlog>
  @type rewrite_tag_filter
  <rule>
    key ip-version
    pattern ^(.+)$
    tag ${tag}.$1
  </rule>
</match>

<filter pf.filterlog.4>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-text,length,source-address,destination-address
    parser_type fast
  </parse>
</filter>

<filter pf.filterlog.6>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version,class,flow-label,hop-limit,protocol-text,protocol-id,length,source-address,destination-address
    parser_type fast
  </parse>
</filter>

<match pf.filterlog.*>
  @type rewrite_tag_filter
  <rule>
    key protocol-text
    pattern ^(.+)$
    tag ${tag}.$1
  </rule>
</match>

<filter pf.filterlog.4.tcp>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-text,length,source-address,destination-address,source-port,destination-port,data-length,tcp-flags,sequence-number,ack-number,tcp-window,urg,tcp-options
    parser_type fast
  </parse>
</filter>

<filter pf.filterlog.4.udp>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-text,length,source-address,destination-address,source-port,destination-port,data-length
    parser_type fast
  </parse>
</filter>

<filter pf.filterlog.6.tcp>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version,class,flow-label,hop-limit,protocol-text,protocol-id,length,source-address,destination-address,source-port,destination-port,data-length,tcp-flags,sequence-number,ack-number,tcp-window,urg,tcp-options
    parser_type fast
  </parse>
</filter>

<filter pf.filterlog.6.udp>
  @type parser
  key_name message
  reserve_data true
  reserve_time true
  <parse>
    @type csv
    keys rule-number,sub-rule-number,anchor,tracker,real-interface,reason,action,direction,ip-version,class,flow-label,hop-limit,protocol-text,protocol-id,length,source-address,destination-address,source-port,destination-port,data-length
    parser_type fast
  </parse>
</filter>

<filter pf.filterlog.**>
  @type geoip
  geoip_lookup_keys source-address,destination-address
  geoip2_database /opt/GeoLite2-City.mmdb
  <record>
    source-country ${country.names.en["source-address"]}
    source-country-code ${country.iso_code["source-address"]}
    source-city ${city.names.en["source-address"]}
    destination-country ${country.names.en["destination-address"]}
    destination-country-code ${country.iso_code["destination-address"]}
    destination-city ${city.names.en["destination-address"]}
  </record>
</filter>

<filter pf.**>
  @type record_transformer
  <record>
    log-type ${record["ident"]}
  </record>
  remove_keys host,pri,ident,pid,msgid,extradata,rule-number,sub-rule-number,anchor,tracker,reason,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,length,source-port,data-length,sequence-number,ack-number,tcp-window,urg,tcp-options,class,flow-label,hop-limit
</filter>

<match pf.**>
  @type loki
  url "http://loki:3100"
  include_thread_label false
  drop_single_key true
  <label>
    log_type $.log-type
    real_interface $.real-interface
    direction $.direction
    protocol_text $.protocol-text
    action $.action
    source_address $.source-address
    source_country $.source-country
    source_country_code $.source-country-code
    destination_address $.destination-address
    destination_country $.destination-country
    destination_country_code $.destination-country-code
    destination_port $.destination-port
  </label>
  <buffer>
    flush_interval 10s
    flush_at_shutdown true
  </buffer>
</match>
