crowdsec/pkg/parser/tests/base-grok-no-subnode/base-grok.yaml
Thibault bui Koechlin 88c72340e3 unique pattern names
2020-05-24 12:44:33 +02:00

14 lines
276 B
YAML

filter: "evt.Line.Labels.type == 'testlog'"
debug: true
onsuccess: next_stage
name: tests/base-grok
pattern_syntax:
MYCAP2: ".*"
grok:
pattern: ^xxheader %{MYCAP2:extracted_value} trailing stuff$
apply_on: Line.Raw
statics:
- meta: log_type
value: parsed_testlog