1rule=WIN:<%n1:number%>1 %-:date-rfc5424% %n2:word% %v_tag:word% - - - %v_svc:word% %v_ret:word% %v_os:word% %v_msg:rest%
2annotate=WIN:+v_analytics_prefix="EvntSLog: "
3
4rule=ESX:<%-:number%>%-:date-rfc5424% %-:word% %v_tag:char-to:\x3a%: %v_msg:rest%
5annotate=ESX:+v_svc="SER2"
6annotate=ESX:+v_ret="Y01"
7annotate=ESX:+v_file="esx"
8annotate=ESX:+v_os="ESX"
9
10rule=LNX:<%-:number%>%-:date-rfc3164% %v_hostname:word% %v_tag:char-to:\x3a%: {%v_svc:char-to:\x2e%.%v_file:word% %v_ret:word% %v_os:word% [%v_forward:char-to:\x5d%]} %v_msg:rest%
11rule=LNX:<%-:number%>%-:date-rfc3164% %v_hostname:word% %v_tag:char-to:\x20% {%v_svc:char-to:\x2e%.%v_file:word% %v_ret:word% %v_os:word% [%v_forward:char-to:\x5d%]} %v_msg:rest%
12
13rule=FromFile:<%n1:number%>%-:date-rfc3164% %v_hostname:word% Process2: {%v_svc:char-to:\x2e%.%-:word% %v_ret:word% %v_os:word% [%v_forward:char-to:\x5d%]} (/%v_file:char-to:\x29%) %v_msg:rest%
14annotate=FromFile:+v_tag="Process2"
15