<div dir="ltr">Hi Daniel!<div><br></div><div>Your log does not conform to either RFC-3164 or RFC-5424, it looks like kind-of cisco format to me.</div><div>I've tried one or two ideas, using our `default-network-drivers()` which includes the cisco-parser() but it is not dealing with it properly.</div><div><br></div><div>On second try, I've experimented with `kv-parser()` so the key-value parts in the message will be parsed in a structured format and after that you can use a rewrite rule to modify HOST field of the message.</div><div>I had to adjust the pair-separator option to get an optimal result.</div><div>`parser { kv-parser( prefix(".kv.") pair-separator("]")); };`<br></div><div><br></div><div>After a successful parsing, you can use a rewrite rule to set the HOSTNAME.</div><div>rewrite { set("${.kv.ID}" value("HOST")); };</div><div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">There is one catch: you need to know the name of the key: "Node ID" or "Hostname", which comes from the log message.</div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">So, if this expression is not fix, then your config will not work.</div></div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">You can also see that I've added the key "ID" rather than "Node ID", since your log message does not quote the keys in it and</div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">in this case kv-parser will only use the "ID" from "Node ID" part which leads to that similar key-values are overwritten: "App ID", "Cluster ID"</div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">I will think about it, but hopefully others will come up with a better idea. :)</div><div><br></div><div>Regards,</div><div>Gabor</div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 15, 2018 at 6:37 AM, Daniel Ehrlich <span dir="ltr"><<a href="mailto:Daniel.Ehrlich@usq.edu.au" target="_blank">Daniel.Ehrlich@usq.edu.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-AU" link="#0563C1" vlink="#954F72"><div class="m_8510411026202834424m_-8353281739125671589WordSection1"><p class="MsoNormal">Hi,<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Hoping you can assist me, I haven’t really come across anything that makes full sense to me in my searching of various sites/forums.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">This is an example log.<u></u><u></u></p><p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Lucida Console"">Jun 14 11:57:27 PM.685 UTC : %UC_LOGIN-4-AuthenticationFail<wbr>ed: %[Login Date/Time=06/15/2018 at 09:57:27][Login IP Address/Hostname=10.25.1.16][L<wbr>ogin Interface=cucm-uds][Login UserID=POBAR][App ID=Cisco Tomcat][Cluster ID=][Node ID=cucmsub-prd-t2]: Login Authentication failed.</span><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Syslog-ng reads the $HOST as PM.685 ; can I get it to rewrite host as cucmsub-prd-t2 ? i.e. Node ID=<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks you<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="color:black">Kind Regards,</span><span style="font-family:"Times New Roman",serif;color:black"><u></u><u></u></span></p><p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">Daniel Ehrlich<u></u><u></u></span></b></p><p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">MastInfoSysSec, DipBA, SSCP, F5-CA, Splunk CA</span></i><i><span style="font-size:8.0pt;color:black"><u></u><u></u></span></i></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">ICT Security Officer<b><br></b></span><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">ICT Client Services|Infrastructure Services</span><span style="font-family:"Verdana",sans-serif;color:#7f7f7f"><br></span><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">Phone: +61 7 4687 5600 Email: </span><span style="color:black"><a href="mailto:Daniel.Ehrlich@usq.edu.au" target="_blank"><span style="color:blue">Daniel.Ehrlich@usq.edu.<wbr>au</span></a></span><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">Toowoomba | Queensland | 4350 | Australia</span><span style="color:black"><u></u><u></u></span></p><p class="MsoNormal"><u></u> <u></u></p></div><pre>______________________________<wbr>______________________________<wbr>_
This email (including any attached files) is confidential and is for the intended recipient(s) only. If you received this email by mistake, please, as a courtesy, tell the sender, then delete this email.
The views and opinions are the originator's and do not necessarily reflect those of the University of Southern Queensland. Although all reasonable precautions were taken to ensure that this email contained no viruses at the time it was sent we accept no liability for any losses arising from its receipt.
The University of Southern Queensland is a registered provider of education with the Australian Government.
(CRICOS Institution Code QLD 00244B / NSW 02225M, TEQSA PRV12081 )
</pre></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 15, 2018 at 6:37 AM, Daniel Ehrlich <span dir="ltr"><<a href="mailto:Daniel.Ehrlich@usq.edu.au" target="_blank">Daniel.Ehrlich@usq.edu.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-AU" link="#0563C1" vlink="#954F72"><div class="m_2046606864480279824WordSection1"><p class="MsoNormal">Hi,<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Hoping you can assist me, I haven’t really come across anything that makes full sense to me in my searching of various sites/forums.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">This is an example log.<u></u><u></u></p><p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Lucida Console"">Jun 14 11:57:27 PM.685 UTC : %UC_LOGIN-4-<wbr>AuthenticationFailed: %[Login Date/Time=06/15/2018 at 09:57:27][Login IP Address/Hostname=10.25.1.16][<wbr>Login Interface=cucm-uds][Login UserID=POBAR][App ID=Cisco Tomcat][Cluster ID=][Node ID=cucmsub-prd-t2]: Login Authentication failed.</span><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Syslog-ng reads the $HOST as PM.685 ; can I get it to rewrite host as cucmsub-prd-t2 ? i.e. Node ID=<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks you<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="color:black">Kind Regards,</span><span style="font-family:"Times New Roman",serif;color:black"><u></u><u></u></span></p><p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">Daniel Ehrlich<u></u><u></u></span></b></p><p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">MastInfoSysSec, DipBA, SSCP, F5-CA, Splunk CA</span></i><i><span style="font-size:8.0pt;color:black"><u></u><u></u></span></i></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">ICT Security Officer<b><br></b></span><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">ICT Client Services|Infrastructure Services</span><span style="font-family:"Verdana",sans-serif;color:#7f7f7f"><br></span><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">Phone: +61 7 4687 5600 Email: </span><span style="color:black"><a href="mailto:Daniel.Ehrlich@usq.edu.au" target="_blank"><span style="color:blue">Daniel.Ehrlich@usq.edu.<wbr>au</span></a></span><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7f7f7f">Toowoomba | Queensland | 4350 | Australia</span><span style="color:black"><u></u><u></u></span></p><p class="MsoNormal"><u></u> <u></u></p></div><pre>______________________________<wbr>______________________________<wbr>_
This email (including any attached files) is confidential and is for the intended recipient(s) only. If you received this email by mistake, please, as a courtesy, tell the sender, then delete this email.
The views and opinions are the originator's and do not necessarily reflect those of the University of Southern Queensland. Although all reasonable precautions were taken to ensure that this email contained no viruses at the time it was sent we accept no liability for any losses arising from its receipt.
The University of Southern Queensland is a registered provider of education with the Australian Government.
(CRICOS Institution Code QLD 00244B / NSW 02225M, TEQSA PRV12081 )
</pre></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>