pfSense_2.2_firewall_log_extractor

{
  "extractors": [
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [
        {
          "config": {},
          "type": "numeric"
        }
      ],
    {
      "condition_type": "regex",
      "condition_value": "filterlog:.*,(?:pass|block),.*",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog:.*,(pass|block),.*"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "action",
      "title": "pfSense Action"
    },
    {
      "condition_type": "none",
      "condition_value": ".* (?:pass|block) .* on (?:[^:]+):.* (?:TCP|UDP|IGMP|ICMP) .* (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*) [<|>] (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*): (?:.*)",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog:.*[0-9]{1,10},[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3},[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3},(\\d+),"
      },
      "extractor_type": "regex",
      "order": 4,
      "source_field": "message",
      "target_field": "srcport",
      "title": "pfSense Source Port"
    },
    {
      "condition_type": "none",
      "condition_value": ".* (?:pass|block) .* on (?:[^:]+):.* (?:TCP|UDP|IGMP|ICMP) .* (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*) [<|>] (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*): (?:.*)",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog:.*[0-9]{1,10},[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3},([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
      },
      "extractor_type": "regex",
      "order": 5,
      "source_field": "message",
      "target_field": "destip",
      "title": "pfSense Destination IP"
    },
    {
      "condition_type": "none",
      "condition_value": ".* (?:pass|block) .* on (?:[^:]+):.* (?:TCP|UDP|IGMP|ICMP) .* (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*) [<|>] (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*): (?:.*)",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog:.*[0-9]{1,10},[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3},[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3},\\d+,(\\d+)"
      },
      "extractor_type": "regex",
      "order": 6,
      "source_field": "message",
      "target_field": "destport",
      "title": "pfSense Destination Port"
    },
    {
      "condition_type": "none",
      "condition_value": ".* (?:pass|block) .* on (?:[^:]+):.* (?:TCP|UDP|IGMP|ICMP) .* (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*) [<|>] (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*): (?:.*)",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog: \\d+,\\d+,,\\d+,(.+),match,.*"
      },
      "extractor_type": "regex",
      "order": 1,
      "source_field": "message",
      "target_field": "interface",
      "title": "pfSense Interface"
    },
    {
      "condition_type": "none",
      "condition_value": ".* (?:pass|block) .* on (?:[^:]+):.* (?:TCP|UDP|IGMP|ICMP) .* (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*) [<|>] (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*): (?:.*)",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog: .*,(udp|tcp),.*"
      },
      "extractor_type": "regex",
      "order": 2,
      "source_field": "message",
      "target_field": "protocol",
      "title": "pfSense Protocol"
    },
    {
      "condition_type": "none",
      "condition_value": ".* (?:pass|block) .* on (?:[^:]+):.* (?:TCP|UDP|IGMP|ICMP) .* (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*) [<|>] (?:\\d+\\.\\d+\\.\\d+\\.\\d+)\\.?(?:\\d*): (?:.*)",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "filterlog:.*,[0-9]{1,10},([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
      },
      "extractor_type": "regex",
      "order": 3,
      "source_field": "message",
      "target_field": "srcip",
      "title": "pfSense Source IP"
    }
  ],
  "version": "1.1.0-beta.2 (e5c1876)"
}

I tried importing this on Graylog 1.2 & I get "Invalid JSON". Any idea why?

Edit: Removing lines 3-11 seemed to fix it for me. I'm not sure what they are needed for. I compared this extractor to the one for pfSense 2.1 & older & that codeblock seemed to be the outlier: https://www.graylog.org/resource/extractor/544abf7fe4b02f0fce94254f/