-
Notifications
You must be signed in to change notification settings - Fork 3
/
vmware_syslog_log.json
38 lines (37 loc) · 1.09 KB
/
vmware_syslog_log.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
"vm_syslog_log" : {
"title" : "vmware syslog",
"description" : "vmware's syslog format",
"url" : "",
"regex" : {
"std" : {
"pattern" : "^(?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z) (?<eventtype>[\\-\\w]+)(\\[(?<pid>\\d+)\\])?: ((?<eventaction>.*): )?(?<body>.*)$"
}
},
"level-field" : "body",
"level" : {
"warning" : "(?:warn|WARN)",
"error" : "(?:FAIL|fail|error|ERROR)",
"info" : "(?:info|INFO|notice|NOTICE)"
},
"value" : {
"eventtype" : {
"kind" : "string",
"identifier" : true
},
"pid" : {
"kind" : "integer",
"identifier" : true
},
"eventaction" : {
"kind" : "string",
"identifier" : true
}
},
"sample" : [
{
"line" : "2015-06-08T23:58:35Z iscsid: Notice: Reclaimed Channel (H43 T58 C0 oid=3b)"
}
]
}
}