Huawei Network Devices Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="huawei", product="network_devices", target_dataset="huawei_network_devices_raw", no_hit=keep]
//This parsing rule is configured for default settings on Huawei Switches and Routers. The time zone is UTC +00:00, and it is not visible in the syslog.
filter _raw_log ~= "\w{3}\s+\d{1,2}\s\d{4}\s\d{2}\:\d{2}\:\d{2}"
| alter 
    tmp_time = arrayindex(regextract(_raw_log,"\w{3}\s+\d{1,2}\s\d{4}\s\d{2}\:\d{2}\:\d{2}"),0)
| alter
    _time = parse_timestamp("%h %e %G %T",tmp_time)
| fields -tmp_time;