From 54b8e568a8e58bf446bfd462427243d7561619bd Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Tue, 9 Jun 2020 16:59:25 -0400
Subject: [PATCH] Support Cisco Nexus

---
 .../conf.d/filters/cisco/cisco_syslog.conf    | 28 +++++++++++++++++++
 tests/test_cisco_ios.py                       |  4 ++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/package/etc/conf.d/filters/cisco/cisco_syslog.conf b/package/etc/conf.d/filters/cisco/cisco_syslog.conf
index 44f8d5c..5c56531 100644
--- a/package/etc/conf.d/filters/cisco/cisco_syslog.conf
+++ b/package/etc/conf.d/filters/cisco/cisco_syslog.conf
@@ -42,6 +42,34 @@ parser cisco-parser-ex{
                     condition(not host("."))
                 );
             };
+        } elif {
+            # Cisco Nexus Switch
+            filter {
+                message('^<(?<pri>\d*)> ?20\d\d (\w\w\w \d+ \d\d:\d\d:\d\d(?:.\d1,3)?) ([^ ]+) ((%[^\: ]+)\:? ?.*)'
+                flags(store-matches));
+            };            
+            rewrite {
+                set(
+                    "${3}",
+                    value("HOST")                
+                );            
+                set(
+                    "${4}",
+                    value("MESSAGE")                
+                );
+                set(
+                    "${5}",
+                    value("PROGRAM")                
+                );
+            };
+            parser { date-parser-nofilter(format(
+                '%b %d %H:%M:%S.%f',
+                '%b %d %H:%M:%S',
+                )
+                template("$2"));
+            };
+
+
         } elif {
             #Cisco IOS Other
             filter {
diff --git a/tests/test_cisco_ios.py b/tests/test_cisco_ios.py
index 2de6739..97c7eab 100644
--- a/tests/test_cisco_ios.py
+++ b/tests/test_cisco_ios.py
@@ -39,7 +39,9 @@
     "{{ mark }}{{ host }}: {{ bsd }}.{{ millisec }}: %SYSMGR-STANDBY-3-SHUTDOWN_START: The System Manager has started the shutdown procedure. {{ bsd }}.{{ millisec }}",
     "{{ mark }}*{{ bsd }}.{{ millisec }} {{ tzname }}: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) {{ host }}",
     "{{ mark }}84027: {{ bsd }}.{{ millisec }} dst: %SYS-5-CONFIG_I: Configured from console by username on vty0 ({{ host }})",
-    "{{ mark }}{{ host }}: *spamApTask1: {{ bsd }}.{{ millisec }}: %CAPWAP-4-DISC_INTF_ERR2: [PA]capwap_ac_sm.c:2053 Ignoring Primary discovery request received on a wrong VLAN (202) on interface (8) from AP 00:b7:00:00:00:00"
+    "{{ mark }}{{ host }}: *spamApTask1: {{ bsd }}.{{ millisec }}: %CAPWAP-4-DISC_INTF_ERR2: [PA]capwap_ac_sm.c:2053 Ignoring Primary discovery request received on a wrong VLAN (202) on interface (8) from AP 00:b7:00:00:00:00",
+    "{{ mark }} 2014 {{ bsd }}.{{ millisec }} {{ host }} %MODULE-2-MOD_SOMEPORTS_FAILED: Module 13 (Serial number: JAF12345678) reported failure on ports Eth13/17-20 (Ethernet) due to hardware not accessible in device DEV_CLP_FWD(device error 0xca804200)",
+    "{{ mark }} 2014 {{ bsd }} {{ host }} %MODULE-2-MOD_SOMEPORTS_FAILED: Module 13 (Serial number: JAF12345678) reported failure on ports Eth13/17-20 (Ethernet) due to hardware not accessible in device DEV_CLP_FWD(device error 0xca804200)",
 ]
 
 testdata_uptime = [