Merge pull request #1175 from splunk/fix-cisco-ftd-rfc

fix(cisco_ftd): When cisco FTD wrong source type
splunk · May 28, 2021 · 455e0be · 455e0be
2 parents b7dcb80 + 2436aed
commit 455e0be
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/package/etc/conf.d/conflib/syslog/app-cisco_syslog_bsd.conf b/package/etc/conf.d/conflib/syslog/app-cisco_syslog_bsd.conf
@@ -1,16 +1,19 @@
 block parser cisco_syslog_bsd-parser() {    
  channel {
         filter {
-            message(
-                '^%(.+)-([0-7])-([^\: ]+)'
+            match(
+                '^(%(.+)-([0-7])-([^\: ]+))([: ]) ?(.*)'
                 flags(store-matches)
+                value("MESSAGE")
             )
         };
         rewrite {
             set("$1" value(".cisco.identifier"));
             set("$2" value(".cisco.facility"));
             set("$3" value(".cisco.severity"));
             set("$4" value(".cisco.mnemonic"));
+            set("$5" value(".cisco.seperator"));
+            set("$6" value(".cisco.message"));
         };
         rewrite {
             r_set_splunk_dest_default(