Suricata logs to Logstash with Filebeat on pfSense 2.4

Install Filebeat FreeBSD package

https://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/

Find beats-x.x.x.txz

curl -o beats-x.x.x.txz https://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/beats-x.x.x.txz
pkg add beats-x.x.x.txz

Download modules

https://www.elastic.co/downloads/past-releases

Download same version Filebeat LINUX 64-BIT

curl -o filebeat-x.x.x-linux-x86_64.tar.gz https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-x.x.x-linux-x86_64.tar.gz
curl -o filebeat-x.x.x-linux-x86_64.tar.gz.sha512 https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-x.x.x-linux-x86_64.tar.gz.sha512
sha256 -c filebeat-x.x.x-linux-x86_64.tar.gz.sha512
tar zxvf filebeat-x.x.x-linux-x86_64.tar.gz
mv filebeat-x.x.x-linux-x86_64/modules.d /var/db/beats/filebeat/
mv filebeat-x.x.x-linux-x86_64/module /var/db/beats/filebeat/

Configure Filebeat

vi /usr/local/etc/filebeat.yml

filebeat.inputs:
- type: log
  paths:
    - "/var/log/suricata/*/eve.json*"
  fields_under_root: true
  fields:
    tags: ["suricata","json"]
- type: log
  paths:
    - "/var/syslog-ng/default.log"
  fields_under_root: true
  fields:
    tags: ["pfsense"]

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

output.logstash:
  hosts: ["LOGSTASHIP:5044"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging.to_syslog: false
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat.log
  keepfiles: 7

mkdir /var/log/filebeat

/usr/local/sbin/filebeat -c /usr/local/etc/filebeat.yml test config

Enable Filebeat to run on boot

ln -s /usr/local/etc/rc.d/filebeat /usr/local/etc/rc.d/filebeat.sh

echo "filebeat_enable=yes" >> /etc/rc.conf.local
echo "filebeat_conf=/usr/local/etc/filebeat.yml" >> /etc/rc.conf.local

Logstash

vi 01-inputs.conf

input {
  beats { 
    port => 5044 
  }
}

vi 12-suricata.conf

filter {
  if "suricata" in [tags] {
    json {
      source => "message"
    }
    date {
      match => [ "timestamp", "ISO8601" ]
    }
    if ![geoip] and [src_ip] !~ /^(10\.|192\.168\.)/ { 
      geoip {
        add_tag => [ "GeoIP" ] 
        source => "src_ip" 
      }
    }
  }
}

vi 30-outputs.conf

output {
    if "pfsense" in [tags] {
        elasticsearch {
            hosts => localhost
            index => "pfsense-%{+YYYY.MM}"
        }
    }
    if "suricata" in [tags] {
        elasticsearch {
            hosts => localhost
            index => "suricata-%{+YYYY.MM}"
        }
    }
}