#############################################################################

@version: 3.35
@include "scl.conf"

source s_network {
	network(
          ip("localhost")
          port(1234)
          flags("no-parse")
	);
};

destination d_local {
  file("/dev/stdout" template("$DATE $HOST $PROGRAM: $MSG - $(format-json --key .cisco.*)\n"));
};

@define cisco_template "$MSG"
@define cisco_prefix ".cisco."
parser p_cisco_triplet {
            # parse syslog <pri> field
            syslog-parser(flags(no-header) template(`cisco_template`));

            # split msg and header right before the '%', Cisco messages may
            # have a variable number of ': ' terminated values
            csv-parser(delimiters(chars('') strings(': %'))
                       columns('1', '2', '3') flags(greedy) drop-invalid(yes));
                                                                                                                                       
            csv-parser(delimiters(chars(':')) template("$2") columns('3'));                                                          
            cisco-triplet-parser(template("$3") prefix(`cisco_prefix`));
};

log {
  source(s_network);
  parser(p_cisco_triplet);
  destination(d_local);
};
