diff --git a/src/formats/syslog_log.json b/src/formats/syslog_log.json index 2aa84a291be..4204af1ce63 100644 --- a/src/formats/syslog_log.json +++ b/src/formats/syslog_log.json @@ -6,7 +6,7 @@ "url": "http://en.wikipedia.org/wiki/Syslog", "regex": { "std": { - "pattern": "^(?(?:\\S{3,8}\\s+\\d{1,2} \\d{2}:\\d{2}:\\d{2}|\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3,6})?(?:Z|(?:\\+|-)\\d{2}:\\d{2})))(?: (?[a-zA-Z0-9:][^ ]+[a-zA-Z0-9]))?(?: \\[CLOUDINIT\\])?(?:(?: syslogd [\\d\\.]+|(?: (?(?(?:[^\\[:]+|[^ :]+))(?:\\[(?\\d+)\\](?: \\([^\\)]+\\))?)?))):\\s*(?.*)$|:?(?:(?: ---)? last message repeated \\d+ times?(?: ---)?))" + "pattern": "^(?(?:\\S{3,8}\\s+\\d{1,2} \\d{2}:\\d{2}:\\d{2}|\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3,6})?(?:Z|(?:\\+|-)\\d{2}:\\d{2})))(?: (?[a-zA-Z0-9:][^ ]+[a-zA-Z0-9]))?(?: \\[CLOUDINIT\\])?(?:(?: syslogd [\\d\\.]+|(?: (?(?(?:[^\\[:]+|[^ :]+))(?:\\[(?\\d+)\\](?: \\([^\\)]+\\))?)?))):?\\s*(?.*)$|:?(?:(?: ---)? last message repeated \\d+ times?(?: ---)?))" }, "rfc5424": { "pattern": "^<(?\\d+)>(?\\d+) (?\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{6})?(?:[^ ]+)?) (?[^ ]+|-) (?(?[^ ]+|-) (?[^ ]+|-) (?[^ ]+|-)) (?\\[(?:[^\\]\"]|\"(?:\\.|[^\"])+\")*\\]|-|)\\s+(?.*)" @@ -96,6 +96,9 @@ }, { "line": "Jan 4 10:23:26 Tims-MacBook-Air Setup Assistant[1173]: Creating connection" + }, + { + "line": "2025-04-15T17:36:24.135033+02:00 myhostname sshd[730594] Disconnected from authenticating user root 218.92.0.111 port 37632 [preauth]" } ] }