# You should not use special characture in the value keys
#
# A single whitespace in `line` will match any number of whitespaces. You should be explicit when
# Matching white space in `values`
#
prefix:
  values:
    host: ([^ ]+)
    date: (\d+ \w+ +\d+)
    time: (\d\d:\d\d:\d\d)
    timeZone: (\w\w\w)
    tag: ([\w\d-]+)
  line: '{host}: {date} {time} {timeZone}: %{tag}:'

messages:
  # 'error' should be unique and vendor agnostic. Currently we are using the JUNOS syslog message name as the canonical name.
  # This may change if we are able to find a more well defined naming system.
  - error: USER_LOGIN
    tag: AUTHPRIV-6-SYSTEM_MSG
    values:
      user: (\w+)
      uid: (\d+)
      sshPid: (\d+)
    replace: {}
    line: 'pam_unix(dcos_sshd:session): session opened for user {user} by (uid={uid}) - dcos_sshd[{sshPid}]'
    model: NO_MODEL
    mapping:
      variables:
        users//user//{user}//uid: uid
      static:
        users//user//{user}//action//login: True

Add config for cisco nexus
Add config for cisco nexus

I have added the prefix config and one error. I will add more over the
coming weeks once I have identified useful ones to add.
