pattern_syntax:
ACTION: '(A|D|R)'
ZONE: '(LAN|WAN|LOCAL|VPN|DMZ)'
nodes:
- grok:
pattern: '^\[%{ZONE:src_zone}_%{ZONE:dst_zone}-%{ACTION:action}-%{INT:rule_id}\] DESCR="%{DATA:fw_descr}" IN=%{DATA:skip1} SRC=%{IP:source_ip} DST=%{IP:dst_ip} LEN=%{DATA:skip2} PROTO=%{WORD:proto} SPT=%{INT:src_port} DPT=%{INT:dst_port} %{GREEDYDATA:unparsed_remainder}'
apply_on: message
pattern_syntax:
ACTION: '(A|D|R)'
ZONE: '(LAN|WAN|LOCAL|VPN|DMZ)'
nodes:
- grok:
pattern: '^\[%{ZONE:src_zone}_%{ZONE:dst_zone}-%{ACTION:action}-%{INT:rule_id}\] DESCR="%{DATA:fw_descr}" IN=%{DATA:skip1} SRC=%{IP:source_ip} DST=%{IP:dst_ip} LEN=%{DATA:skip2} PROTO=%{WORD:proto} SPT=%{INT:src_port} DPT=%{INT:dst_port} %{GREEDYDATA:unparsed_remainder}'
apply_on: message