| 1 | pattern: | |
| 2 | (?x) |
| 3 | ^Complex \s+ log: \s+ |
| 4 | (?P<USER_EMAIL>(?P<USER_NAME>[^@]+)@(?P<USER_DOMAIN>[^ ]+)) \s+ |
| 5 | accessed \s+ |
| 6 | (?P<API_PATH>/[^ ?]+)(?:\?(?P<QUERY_PARAMS>[^ ]+))? \s+ |
| 7 | with \s+ IP \s+ (?P<CLIENT_IP>(?P<IP_OCTETS>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})) \s+ |
| 8 | at \s+ (?P<TIMESTAMP>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z) \s+ |
| 9 | status=(?P<STATUS_CODE>\d+) \s+ |
| 10 | time=(?P<RESPONSE_TIME_MS>\d+)ms |
| 11 | |
| 12 | inject: |
| 13 | - key: MESSAGE |
| 14 | value: 'API access by ${USER_EMAIL} to ${API_PATH}' |
| 15 | - key: SYSLOG_IDENTIFIER |
| 16 | value: api-server |
| 17 | |
| 18 | rewrite: |
| 19 | - key: PRIORITY |
| 20 | match: '^[123]' |
| 21 | value: 6 |
| 22 | - key: PRIORITY |
| 23 | match: '^4' |
| 24 | value: 4 |
| 25 | - key: PRIORITY |
| 26 | match: '^5' |
| 27 | value: 3 |
| 28 | - key: STATUS_FAMILY |
| 29 | match: '^(?P<first_digit>[1-5])' |
| 30 | value: '${first_digit}xx' |