Skip to content

Commit

Permalink
[fix] lost brace in merge (#619)
Browse files Browse the repository at this point in the history
* [filtermod] cisco date parser issues

False error reported when cisco device sends uptime
device reported time errors will now use the indexed field cisco_time_error
Add micro seconds format without year

* Update cisco_syslog.conf

Use cisco time even when wrong

* Update cisco_syslog.conf
  • Loading branch information
Ryan Faircloth authored and GitHub committed Aug 7, 2020
1 parent b4f2620 commit ab4c01f
Showing 1 changed file with 6 additions and 8 deletions.
14 changes: 6 additions & 8 deletions package/etc/conf.d/filters/cisco/cisco_syslog.conf
Original file line number Diff line number Diff line change
Expand Up @@ -102,14 +102,13 @@ parser cisco-parser-ex{
filter {
match('^(\*|\.)$' value("7"));
};
rewrite { set("cisco reported time error : ${7}" value("fields.cisco_time_error"));
rewrite { set("cisco reported time error : ${7}" value("fields.cisco_time_error"));};
};
if {
if {
filter {
match('^\w\w\w' value("8"));
};
parser { date-parser-nofilter(format(
filter {
match('^\w\w\w' value("8"));
};
parser { date-parser-nofilter(format(
'%b %d %H:%M:%S.%f',
'%b %d %H:%M:%S',
'%b %d %I:%M:%S %p.%f',
Expand All @@ -118,8 +117,7 @@ parser cisco-parser-ex{
'%b %d %H:%M:%S.%f',
'%b %d %Y %H:%M:%S')
template("$8"));
};
};
};
};
} else {
#Cisco AireOS format
Expand Down

0 comments on commit ab4c01f

Please sign in to comment.