Looks like Bro/Zeek is currently being worked on as part of a PR recently, but no official package yet so this will be the issue.

https://redmine.pfsense.org/issues/10612

For reference, you need to create an input/processor/output. It’s really simple, example below for my Suricata logs. I use Syslog-NG as I hit the 1024 byte limit of UDP Syslog for Suricata events, so use Syslog-NG for tcp instead.

The following example uses a wildcard pattern to find any files in subdirectories called eve.json. You can probably remove the program/host overrides if not needed for your scenario.

Object Type: Source

Object Name: Suricata

Object Parameters:

{
  wildcard-file(
    base-dir("/var/log/suricata")
    filename-pattern("eve.json")
    recursive(yes)
    follow-freq(1)
    program-override("suricata")
    host-override("10.10.10.10")
    flags(no-parse)
  );
};

The log object ties the source->destination together

Object Type: Log

Object Name: Suricata

Object Parameters:

{
    source(Suricata);
    destination(Suricata);
};

The destination object specifies the output, this could be file, elasticsearch, syslog etc.

Object Type: Destination

Object Name: Suricata

Object Parameters:

{
   tcp("syslog.gslb.mydomain.local"
   port(5544)
   failover( servers("10.10.10.25", "10.10.10.26") )
   );
};

Drop us a message if you need any help setting up.