Pfsense OpenVPN parsing for RFC 5424 format

[utkarshborawake]

I have added the custom syslog parser to my security onion for parsing the pfsense openvpn logs. But this parser only parses the BSD format logs. This parser is referred from discusion #3039

Can we parse the RFC 5424 format syslogs from pfsense firewall.
Sample log format:
<36>1 2024-02-27T12:53:12.276694+05:30 pfSense.home.arpa openvpn 373 - - user 'TEST1' could not authenticate.

Syslog

{
  "description" : "syslog",
  "processors" : [
    {
        "dissect": {
                "field": "message",
                "pattern" : "%{message}",
                "on_failure": [ { "drop" : { } } ]
        },
        "remove": {
                "field": [ "type", "agent" ],
                "ignore_failure": true
        }
    },
    {
        "grok":
                {
                        "field": "message",
                        "patterns": [
                                        "^<%{INT:syslog.priority}> %{DATA:source.application}: %{DATE_EU:syslog.timestamp} %{GREEDYDATA:event_data.message}$",
					"^<%{INT:syslog.priority}>%{DATA:syslog.timestamp} %{WORD:source.application}(\\[%{DATA:pid}\\])?: %{GREEDYDATA:real_message}$",
                                        "^%{SYSLOGTIMESTAMP:syslog.timestamp} %{SYSLOGHOST:syslog.host} %{SYSLOGPROG:syslog.program}: CEF:0\\|%{DATA:vendor}\\|%{DATA:product}\\|%{GREEDYDATA:message2}$"
                                    ],
                        "ignore_failure": true
                }
    },
    { "set": { "if": "ctx.source?.application == 'filterlog'", "field": "dataset", "value": "firewall", "ignore_failure": true  } },
    { "set": { "if": "ctx.source?.application == 'openvpn'", "field": "dataset", "value": "vpn", "ignore_failure": true  } },
    { "set": { "if": "ctx.vendor != null", "field": "module", "value": "{{ vendor }}", "ignore_failure": true } },
    { "set": { "if": "ctx.product != null", "field": "dataset", "value": "{{ product }}", "ignore_failure": true } },
    { "set": { "field": "ingest.timestamp",      "value": "{{ @timestamp }}"       } },
    { "date": { "if": "ctx.syslog?.timestamp != null", "field": "syslog.timestamp",       "target_field": "@timestamp",   "formats": ["MMM  d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601", "UNIX"], "ignore_failure": true  } },
    { "set": { "if": "ctx.source?.application == 'sshguard'", "field": "module", "value": "pfsense", "override": true  } },
    { "set": { "if": "ctx.source?.application == 'openvpn'", "field": "module", "value": "pfsense", "override": true  } },
    { "remove":         { "field": ["pid", "program"],  "ignore_missing": true, "ignore_failure": true  } },
    { "pipeline": { "if": "ctx.vendor != null && ctx.product != null", "name": "{{ vendor }}.{{ product }}", "ignore_failure": true } },
    { "pipeline": { "if": "ctx.dataset == 'firewall'", "name": "filterlog", "ignore_failure": true } },
    { "pipeline": { "if": "ctx.dataset == 'vpn'", "name": "vpn", "ignore_failure": true } },
    { "pipeline":       { "name": "common"                                             } }
  ]
}