Last active
October 24, 2024 13:31
-
-
Save agup006/f64a3b1529df78d020682240aa95f792 to your computer and use it in GitHub Desktop.
includes catch-all parser that puts entire message in "message field"
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[PARSER] | |
Name catch-all | |
Format regex | |
Regex (?<message>.*) | |
[PARSER] | |
Name syslog-rfc5424 | |
Format regex | |
Regex ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$ | |
Time_Key time | |
Time_Format %Y-%m-%dT%H:%M:%S.%L%z | |
Time_Keep On | |
[PARSER] | |
Name syslog-rfc3164-local | |
Format regex | |
Regex ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$ | |
Time_Key time | |
Time_Format %b %d %H:%M:%S | |
Time_Keep On | |
[PARSER] | |
Name syslog-rfc3164 | |
Format regex | |
Regex /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/ | |
Time_Key time | |
Time_Format %b %d %H:%M:%S | |
Time_Keep On |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment