sumologic.json

sumologic.json

{
  "api.version": "v1",
  "sources": [{
    "sourceType" : "LocalFile",
    "name": "web",
    "category": "map-public",
    "pathExpression": "/var/log/web/*.log",
    "timeZone": "America/New_York",
    "filters": [{
      "name": "mask_email",
      "filterType": "Mask",
      "regexp": "email=(.+?)(?=[&\"\s])",
      "mask": "EMAIL_REDACTED"
    }, {
      "name": "mask_ip",
      "filterType": "Mask",
      "regexp": "((?:[0-9]{1,3}\\.){3}[0-9]{1,3})",
      "mask": "IP_REDACTED"
    }]
  }]
}