Update 52-pfsense-nginx.conf

DataConnectors/pfsense/52-pfsense-nginx.conf

@@ -0,0 +1,31 @@
+if $programname == "nginx" then
+{
+    set $!dst = field($msg,32,1);
+    #172.16.4.129
+    set $!user = field($msg,45,2);
+    #set $!user = field($!user,45,2);
+    #- -
+    set $!requesttime = field($msg,91,2);
+    set $!requesttime = field($!requesttime,93,1);
+    #[02/Mar/2021:16:47:31 +0000]
+    set $!url = field($msg,34,2);
+    set $!httpmethod = field($!url,32,1);
+    set $!httpprotocol = field($!url,32,3);
+    set $!url = field($!url,32,2);
+    #"GET /widgets/widgets/snort_alerts.widget.php?getNewAlerts=1614703651591 HTTP/2.0"
+    set $!status = field($msg,34,3);
+    set $!status = field($!status,32,2);
+    #200
+    set $!bytesout = field($msg,34,3);
+    set $!bytesout = field($!bytesout,32,3);
+    #159
+    set $!httpreferrer = field($msg,34,4);
+    #"https://172.16.4.128/"
+    set $!httpuseragent = field($msg,34,6);
+    #"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0"
+
+    $template pfsensenginx_log, "<%pri%>%timereported:::date-rfc3339% %hostname% CEF: 0|NETGATE|pfsense||nginx|access||dst=%$!dst% user=%$!user% requestime=%$!requesttime% httpmethod=%$!httpmethod% url=%$!url% httpprotocol=%$!httpprotocol% status=%$!status% bytes=%$!bytesout% httpreferrer=%$!httpreferrer% httpsuseragent=%$!httpuseragent%"
+    #/var/log/pfsensenginx.log;pfsensenginx_log
+    @@127.0.0.1:25226;pfsensenginx_log
+    stop
+}