Skip to content

[Enhancement] Add support for dnsmasq-dhcp for PFSense integration #17375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
daviddreher2 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

[Enhancement] Add support for dnsmasq-dhcp for PFSense integration #17375

daviddreher2 wants to merge 4 commits into from
+7 −2

Conversation

@daviddreher2
Copy link

@daviddreher2 daviddreher2 commented Feb 11, 2026

Updated ingest pipelines for PFSense DHCP component to support logs from dnsmasq DHCP server, currently only supports deprecated ISC DHCP server logs

Changes:

Default Pipeline

  • added dnsmasq-dhcp to the list for the drop processor
  • added dnsmasq-dhcp to the list for the dhcp pipeline

DHCP Pipeline

  • added Grok pattern to extract dnsmasq log fields to the correct field names
  • added a gsub operator to replace dnsmasq-dhcp with dhcpd in the event.provider field to ensure dashboards work correctly

Checks:

  • Confirmed Grok pattern extracts correctly
  • Confirmed dashboard loads data correctly
  • Checked pipeline for errors

Validations:

  • configure PFSense/OPNsense to use dnsmasq for DHCP
  • Send dnsmasq logs to Elastic agent integration via syslog
  • confirm data

Partially resolves issue #17264

@daviddreher2
Update default.yml
5553ad0 
add dnsmasq-dhcp to the list of exclusions
@daviddreher2
Update default.yml
85ae331 
add dnsmasq-dhcp to dhcp ingest pipeline
@daviddreher2
Update dhcp.yml
f8596a4 
add dnsmasq-dhcp grok pattern
rename change dnsmasq-dhcp to dhcpd in event.provider
@daviddreher2
Update default.yml
0d5a8a4 
added missing quote
@daviddreher2 daviddreher2 requested a review from a team as a code owner February 11, 2026 15:45
@mergify mergify bot mentioned this pull request Feb 11, 2026
Closed
@andrewkroh andrewkroh added Integration:pfsense pfSense (Community supported) Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Feb 11, 2026
@elasticmachine
Copy link

elasticmachine commented Feb 11, 2026

Pinging @elastic/integration-experience (Team:Integration-Experience)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Integration:pfsense pfSense (Community supported) Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@daviddreher2 @elasticmachine @andrewkroh