1# Some sample rules and strings matching them
2
3# Prefix sample:
4# myhostname: code=23
5prefix=%host:char-to:\x3a%:
6rule=prefixed_code:code=%code:number%
7# myhostname: name=somename
8rule=prefixed_name:name=%name:word%
9# Reset prefix to default (empty value):
10prefix=
11
12# Quantity: 555
13rule=tag1:Quantity: %N:number%
14
15# Weight: 42kg
16rule=tag2:Weight: %N:number%%unit:word%
17annotate=tag2:+fat="free"
18
19# %%
20rule=tag3,percent:\x25%%
21annotate=percent:+percent="100"
22annotate=tag3:+whole="whale"
23annotate=tag3:+part="wha"
24
25# literal
26rule=tag4,tag5,tag6,tag4:literal
27annotate=tag4:+this="that"
28
29# first field,second field,third field,fourth field
30rule=csv:%r1:char-to:,%,%r2:char-to:,%,%r3:char-to:,%,%r4:rest%
31
32# CSV: field1,,field3
33rule=better-csv:CSV: %f1:char-sep:,%,%f2:char-sep:,%,%f3:char-sep:,%
34
35# Snow White and the Seven Dwarfs
36rule=tale:Snow White and %company:rest%
37
38# iptables: SRC=192.168.1.134 DST=46.252.161.13 LEN=48 TOS=0x00 PREC=0x00
39rule=ipt:iptables: %dummy:iptables%
40
41# 2012-10-11 src=127.0.0.1 dst=88.111.222.19
42rule=:%date:date-iso% src=%src:ipv4% dst=%dst:ipv4%
43
44# Oct 29 09:47:08 server rsyslogd: rsyslogd's groupid changed to 103
45rule=syslog:%date1:date-rfc3164% %host:word% %tag:char-to:\x3a%: %text:rest%
46
47# Oct 29 09:47:08
48rule=rfc3164:%date1:date-rfc3164%
49
50# 1985-04-12T19:20:50.52-04:00
51rule=rfc5424:%date1:date-rfc5424%
52
53# 1985-04-12T19:20:50.52-04:00 testing 123
54rule=rfc5424:%date1:date-rfc5424% %test:word% %test2:number%
55
56# quoted_string="Contents of a quoted string cannot include quote marks"
57rule=quote:quoted_string=%quote:quoted-string%
58
59# tokenized words: aaa.org; bbb.com; ccc.net
60rule=tokenized_words:tokenized words: %arr:tokenized:; :char-sep:\x3b%
61
62# tokenized regex: aaa.org; bbb.com; ccc.net
63rule=tokenized_regex:tokenized regex: %arr:tokenized:; :regex:[^; ]+%
64
65# regex: abcdef
66rule=regex:regex: %token:regex:abc.ef%
67
68# host451
69# generates  { basename:"host", hostid:451 }
70rule=:%basename:alpha%%hostid:number%
71