syslog-logs

1#If it's syslog, we are going to extract progname from it
2filter: "evt.Line.Labels.type == 'syslog'"1
3onsuccess: next_stage2
4pattern_syntax:3
5  RAW_SYSLOG_PREFIX: '^<%{NUMBER:syslog_priority}>%{NUMBER:syslog_version} %{SYSLOGBASE2} %{DATA:program} (?:%{NUMBER:pid}|-)'
6  RAW_SYSLOG_META: '\[meta sequenceId="%{NOTDQUOTE:seq_id}"\]'
7name: crowdsecurity/syslog-logs
8nodes:4
9  - grok:5
10      # BusyBox syslogd places facility.severity after the hostname.
11      pattern: '^%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{WORD:facility}\.%{WORD:severity} %{SYSLOGPROG}: %{GREEDYDATA:message}$'
12      apply_on: Line.Raw
13  - grok:
14      #this is a named regular expression. grok patterns can be kept into separate files for readability
15      pattern: "^%{SYSLOGLINE}" 
16      #This is the field of the `Event` to which the regexp should be applied
17      apply_on: Line.Raw
18  - grok:
19      #RFC5424 syslog format (used by pfSense and OPNsense with alternative logging)
20      pattern: '%{RAW_SYSLOG_PREFIX} - (?:%{RAW_SYSLOG_META} |- )%{GREEDYDATA:message}'
21      apply_on: Line.Raw
22#if the node was successfull, statics will be applied.
23statics:6
24  - meta: machine
25    expression: evt.Parsed.logsource
26  - parsed: "logsource"
27    value: "syslog"
28# syslog date can be in two different fields (one of hte assignment will fail)
29  - target: evt.StrTime
30    expression: evt.Parsed.timestamp
31  - target: evt.StrTime
32    expression: evt.Parsed.timestamp8601
33  - meta: datasource_path
34    expression: evt.Line.Src
35  - meta: datasource_type
36    expression: evt.Line.Module
37---
38#if it's not syslog, the type is the progname
39filter: "evt.Line.Labels.type not in ['syslog', 'unifi']"1
40onsuccess: next_stage2