app-almost-syslog-cisco_syslog.conf

rewrite set_rfc3164_cisco_syslog{
    set-tag("wireformat:rfc3164_cisco_syslog");
};
filter f_is_rfc3164_cisco_syslog{
    tags("wireformat:rfc3164_cisco_syslog");
};

block parser app-almost-syslog-cisco_syslog() {
    channel {
        if ("`SC4S_DISABLE_DROP_INVALID_CISCO`" eq "yes") {
            parser {
                syslog-parser(
                    flags(assume-utf8, no-header)
                );
                # split msg and header right before the '%', Cisco messages may
                # have a variable number of ': ' terminated values
                csv-parser(delimiters(chars('') strings(': %'))
                        columns('header', 'message')
                        prefix('.tmp.')
                        flags(greedy));
                regexp-parser(
                    prefix(".values.")
                    patterns('^(%(?<identifier>.+)-(?<severity>[0-7])-(?<mnemonic>[^\: ]+))(?<seperator> ?[: ]) *(?<message>.*)')
                    template("%${.tmp.message}")
                );

            };
        } elif {
            parser {
                syslog-parser(
                    flags(assume-utf8, no-header)
                );
                # split msg and header right before the '%', Cisco messages may
                # have a variable number of ': ' terminated values
                csv-parser(delimiters(chars('') strings(': %'))
                        columns('header', 'message')
                        prefix('.tmp.')
                        flags(greedy, drop-invalid));
                regexp-parser(
                    prefix(".values.")
                    patterns('^(%(?<identifier>.+)-(?<severity>[0-7])-(?<mnemonic>[^\: ]+))(?<seperator> ?[: ]) *(?<message>.*)')
                    template("%${.tmp.message}")
                );

            };
        } else {};

        filter {
            #Arista EOS uses a valid semi program syntax this should avoid catching Arista which is otherwise similar to cisco logs
            (
                (   
                    "${.values.identifier}" eq "ACE"
                    or "${.values.identifier}" eq "ASA"
                    or "${.values.identifier}" eq "FWSM"
                    or "${.values.identifier}" eq "PIX"

                    or match(': ?|\*', value('.tmp.header'))
                    or match('[A-Z]{3,4}:?$', value('.tmp.header'))
                    or match('\d+:?$', value('.tmp.header'))
                )
                and not match('[a-z]\S+$', value('.tmp.header'))
                and not match(' \w+\[\d+\]$', value('.tmp.header'));
            )
            or (
                match('LICENSE', value('.values.identifier') type(string) flags(prefix))
                or match('MGBL', value('.values.identifier') type(string) flags(prefix))
                or match('SECURITY', value('.values.identifier') type(string) flags(prefix))
            )
        };

        if {
            parser {
                regexp-parser(
                    prefix(".tmp.")
                    patterns('(?:[ ]|^(?<pri>\<\d+\>)|^)(?<host>(?<!\*)(?!\d{4,})(?!\w+\[)(?:[0-9A-Za-z\-_]{4,}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))')
                    template('${.tmp.header}')
                );
            };
            rewrite {
                set(
                    "${.tmp.host}"
                    value("HOST")
                    condition("${.tmp.host}" ne "")
                );
            };
        };
        if {
            parser {
                regexp-parser(
                    prefix(".tmp.")
                    patterns('(?<timestatus>[\*\.])?(?:(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+(?:\.\d+)?(?:Z|[\+-] *\d+:\d+)|[A-Z][a-z]{2} [ 0123]\d(?: \d{4})? \d\d:\d\d:\d\d(?: [AP]M)?(?:[^ :]+)?)(?: (?<tz>[A-Za-z]{1,4}T))?)')
                    template('${.tmp.header}')
                );
            };
            if {
                filter {
                    "${.tmp.timestatus}" eq "."
                    or "${.tmp.timestatus}" eq "*"
                };
                rewrite {
                    set("0" value("fields.timesync"));
                };
            } else {
                rewrite {
                    set("1" value("fields.timesync"));
                };
            };
            parser { date-parser-nofilter(format(
                '%b %d %H:%M:%S.%f',
                '%b %d %H:%M:%S',
                '%b %d %I:%M:%S %p.%f',
                '%b %d %I:%M:%S %p',
                '%b %d %Y %I:%M:%S %p.%f'
                '%b %d %Y %H:%M:%S.%f',
                '%b %d %Y %H:%M:%S',
                '%Y-%m-%dT%T%z',
                )
                template("${.tmp.timestamp}"));
            };
        } elif {
            #This is "uptime" if we match this isn't a time stamp
             parser {
                regexp-parser(
                    prefix(".values.")
                    patterns('(?<=: )(?<uptime>\d\d:\d\d:\d\d|\d+ \d)')
                    template('${.tmp.header}')
                );
            };
        } else {};

        if ("`SC4S_ENABLE_CISCO_IOS_RAW_MSG`" eq "yes") {
            rewrite {
                r_set_splunk_dest_default(
                    index('netops')
                    sourcetype('cisco:ios')
                    vendor('cisco')
                    product('ios')
                );
            };
        } elif {
            rewrite {
                r_set_splunk_dest_default(
                    index('netops')
                    sourcetype('cisco:ios')
                    vendor('cisco')
                    product('ios')
                );
                set('%${.tmp.message}' value("MESSAGE"));
            };
        } else {};
        
        rewrite(set_rfc);
        rewrite(set_rfc3164);
        rewrite(set_rfc3164_cisco_syslog);
        rewrite(r_set_source_identified);

        if {
            parser { app-parser(topic(cisco_syslog)); };
        };

    };
};
application app-almost-syslog-cisco_syslog[sc4s-almost-syslog] {
	filter {
        message(': %' type(string) flags(substring)) and not message('junos' type(string) flags(substring))
        ;
    };	

    parser { app-almost-syslog-cisco_syslog(); };


};