ListenSyslog Processor extension ?

[Thierry Hanot <th...@infovista.com>]

Hello
I'm currently building a flow to collect and parse syslog messages. My syslog sources mix implementation of the different RFC and some of them don't comply with them.
For message which are not compliant with the RFC , no issue I'm using either a Grok Pattern either regexp to parse them but I have an issue with messages matching the different  regexp pattern for the RFC :

  *   It should be nice to expose in attribute the RFC and the pattern  used to parse the message
  *   The syslog.timestamp is not normalized and is only the part of the message extracted. As the format of the date depend of the RFC and as no information is shared on which one is used it complex to exploit this. Instead put the timestamp into a standard format( YYYY-MM-DD HH:mm:ss SSSZ)  for all the parsed messages can be really usefull.
  *   It can be nice and usefull to be able to add Regexp pattern in this processor with the ability to specify precedence over the other pattern to let this processor parse message which are not compliant with the RFC but not far from it( i.e with the same attribute facility, priority,hostname,.... )
  *   Last , facility and priority are exposed as number. A small option to convert them into a text readable format can be very nice.

Are those evolutions make sense for other users ?

Regards

Thierry