conf: parsers: new parsers syslog-rfc3164-local and syslog-rfc3164
Time_Keep On
[PARSER]
- Name syslog-rfc3164
+ Name syslog-rfc3164-local
Format regex
Regex ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
Time_Key time
Time_Format %b %d %H:%M:%S
Time_Keep On
+
+[PARSER]
+ Name syslog-rfc3164
+ Format regex
+ Regex /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/
+ Time_Key time
+ Time_Format %b %d %H:%M:%S
+ Time_Format %Y-%m-%dT%H:%M:%S.%L
+ Time_Keep On
