| 1 | pattern: | |
| 2 | (?x) |
| 3 | ^(?P<SYSLOG_TIMESTAMP>\w{3} \s+ \d{1,2} \s+ \d{2}:\d{2}:\d{2}) \s+ |
| 4 | (?P<SYSLOG_HOSTNAME>[^ ]+) \s+ |
| 5 | (?P<SYSLOG_TAG>[^:\[\]]+)(?:\[(?P<SYSLOG_PID>\d+)\])?: \s+ |
| 6 | (?P<MESSAGE>.*) |
| 7 | |
| 8 | inject: |
| 9 | - key: SYSLOG_IDENTIFIER |
| 10 | value: '${SYSLOG_TAG}' |
| 11 | - key: PRIORITY |
| 12 | value: 6 |
| 13 | |
| 14 | rewrite: |
| 15 | - key: PRIORITY |
| 16 | match: '.*[Ff]ailed.*|.*[Ee]rror.*' |
| 17 | value: 3 |
| 18 | - key: PRIORITY |
| 19 | match: '.*[Ww]arn.*' |
| 20 | value: 4 |