From 3a808feb21ef7d0759ac313b18d24e3be59d597a Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Tue, 9 Jun 2020 17:00:52 -0400
Subject: [PATCH] Update cisco_syslog.conf

---
 package/etc/conf.d/filters/cisco/cisco_syslog.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/etc/conf.d/filters/cisco/cisco_syslog.conf b/package/etc/conf.d/filters/cisco/cisco_syslog.conf
index cb8378d..a8276a7 100644
--- a/package/etc/conf.d/filters/cisco/cisco_syslog.conf
+++ b/package/etc/conf.d/filters/cisco/cisco_syslog.conf
@@ -45,7 +45,7 @@ parser cisco-parser-ex{
         } elif {
             # Cisco Nexus Switch
             filter {
-                message('^<(?<pri>\d*)> ?20\d\d (\w\w\w \d+ \d\d:\d\d:\d\d(?:.\d{1,3})?) ([^ ]+) ((%[^\: ]+)\:? ?.*)'
+                message('^<(?<pri>\d*)> ?20\d\d (\w\w\w \d+ \d\d:\d\d:\d\d(?:.\d{3,3})?) ([^ ]+) ((%[^\: ]+)\:? ?.*)'
                 flags(store-matches));
             };            
             rewrite {