kierdavis

[sources.audit_raw]
type = "file"
include = [ "/var/log/audit/audit.log" ]
read_from = "beginning"

[transforms.audit_parsed]
type = "remap"
inputs = ["audit_raw"]
source = '''
  # The format is deceptively complex - it looks like key-value pairs but there's actually a few layers of nesting.