mirror of
https://github.com/elastic/logstash.git
synced 2025-04-23 06:08:19 -04:00
0630d51ac1
Priority is "191", not "<191>". The syslog_pri filter expects a raw integer without the extra punctuation.
13 lines
919 B
Text
13 lines
919 B
Text
SYSLOGBASE2 (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:
|
|
SYSLOGPAMSESSION %{SYSLOGBASE} (?=%{GREEDYDATA:message})%{WORD:pam_module}\(%{DATA:pam_caller}\): session %{WORD:pam_session_state} for user %{USERNAME:username}(?: by %{GREEDYDATA:pam_by})?
|
|
|
|
CRON_ACTION [A-Z ]+
|
|
CRONLOG %{SYSLOGBASE} \(%{USER:user}\) %{CRON_ACTION:action} \(%{DATA:message}\)
|
|
|
|
SYSLOGLINE %{SYSLOGBASE2} %{GREEDYDATA:message}
|
|
|
|
# IETF 5424 syslog(8) format (see http://www.rfc-editor.org/info/rfc5424)
|
|
SYSLOG5424PRI <%{NONNEGINT:syslog5424_pri}>
|
|
SYSLOG5424SD \[%{DATA}\]+
|
|
|
|
SYSLOG5424LINE %{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} (?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) (?:%{HOSTNAME:syslog5424_host}|-) (?:%{WORD:syslog5424_app}|-) (?:%{WORD:syslog5424_proc}|-) (?:%{WORD:syslog5424_msgid}|-) (?:%{SYSLOG5424SD:syslog5424_sd}|-) %{GREEDYDATA:syslog5424_msg}
|