Rules (XIF)
[MODEL: dataset = cisco_asr_raw]
alter
get_node_id1 = arraystring(regextract(_raw_log, "\:([^:]+):\S{3}\s\d{2}\s\d{2}:\d{2}:\d{2}"), ""),
get_node_id2 = arraystring(regextract(_raw_log, "([^\:]+)\:[^\:]+\d{2}:\d{2}:\d{2}[^\:]+\:\s[^\[]+\[\d+\]"), ""),
get_process_name = arraystring(regextract(_raw_log, "(\S+)\[\d+\][\s:]+\%"), ""),
get_pid = arraystring(regextract(_raw_log, "\S+\[(\d+)\][\s:]+\%"), ""),
get_msg_group = arraystring(regextract(_raw_log, "\S+\[\d+\][\s:]+\%(.*)\-\d+\-"), ""),
get_msg_group2 = arraystring(regextract(_raw_log, "\%(.*)\-\d+\-"), ""),
get_severity = arraystring(regextract(_raw_log, "\S+\[\d+\][\s:]+\%.*\-(\d+)\-"), ""),
get_severity2 = arraystring(regextract(_raw_log, "\%.*\-(\d+)\-"), ""),
get_msg_code = arraystring(regextract(_raw_log, "\S+\[\d+\][\s:]+\%.*\-\d+\-([^\s\:]+)"), ""),
get_msg_code2 = arraystring(regextract(_raw_log, "\%.*\-\d+\-([^\s\:]+)"), ""),
get_msg = arraystring(regextract(_raw_log, "\S+\[\d+\][\s:]+\%.*\-\d+\-[^\s]+[\s:]+(.*)"), ""),
get_msg2 = arraystring(regextract(_raw_log, "\%.*\-\d+\-[^\s]+[\s:]+(.*)"), "")
| alter
c_get_msg_group = if(get_msg_group !~= "\S", null, get_msg_group),
c_get_severity = if(get_severity !~= "\S", null, get_severity),
c_get_msg_code = if(get_msg_code !~= "\S", null, get_msg_code),
c_get_msg = if(get_msg !~= "\S", null, get_msg)
| alter
check_node_id = if(get_node_id2 ~= "\S+\/\S+\/\S+", arraystring(regextract(get_node_id2, "\s(\S+)\s\S+\/\S+\/\S+"), ""),get_node_id1),
check_msg_group = coalesce(c_get_msg_group, get_msg_group2),
check_severity = coalesce(c_get_severity, get_severity2),
check_msg_code = coalesce(c_get_msg_code, get_msg_code2),
check_msg = coalesce(c_get_msg, get_msg2)
| alter
xdm.source.host.hostname = check_node_id,
xdm.source.process.name = get_process_name,
xdm.source.process.pid = to_integer(get_pid),
xdm.target.resource.type = check_msg_group,
xdm.alert.severity = check_severity,
xdm.target.resource.sub_type = check_msg_code,
xdm.event.description = check_msg;