# Note: Ordering is important in this file. Patterns should be ordered from most specific to least specific. The first
# pattern found to match will be the one used.

# Support for Cisco syslog message patterns
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}: %{STRING:message}
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{NOSPACE:ignore}: %{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction} %{STRING:timezone}: %{STRING:message}
<%{INT:facilityPriority}>%{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction} %{STRING:timezone}:%{WHITESPACE:ignore}%{NOSPACE:ignore}: %{NOSPACE:ignore}:%{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction} %{STRING:timezone}: %{NOSPACE:ignore}: %{STRING:message}
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{NOSPACE:ignore}: %{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}: %{STRING:message}
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction} %{STRING:timezone}: %{STRING:message}

# RFC 3164 with messageId, time
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164 with time
<%{INT:facilityPriority}> %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}> %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{STRING:message}


# RFC 3164/ISO8601 date with time, secondFraction, timezone
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164/ISO8601 date with time, timezone
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164/ISO8601 date with time
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164/ISO8601 date
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} %{STRING:message}


# RFC 3164/ISO8601 date with messageId, time, secondFraction, timezone
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164/ISO8601 date with messageId, time, timezone
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164/ISO8601 date with messageId, time
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 3164/ISO8601 date with messageId
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} [%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} %{NOSPACE:processName}: %{STRING:message}
<%{INT:facilityPriority}>%{NOSPACE:messageId}: %{INT:year}-%{INT:month}-%{INT:day} %{HOSTNAMEORIP:hostname} %{STRING:message}


# RFC 5424 with secondFraction
<%{INT:facilityPriority}>%{INT:version} %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:processName} %{STRING:processId} %{STRING:messageId} - %{STRING:message}
<%{INT:facilityPriority}>%{INT:version} %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:processName} %{STRING:processId} %{STRING:messageId} %{STRING:message}
<%{INT:facilityPriority}>%{INT:version} %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:message}

# RFC 5424
<%{INT:facilityPriority}>%{INT:version} %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:processName} %{STRING:processId} %{STRING:messageId} - %{STRING:message}
<%{INT:facilityPriority}>%{INT:version} %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:processName} %{STRING:processId} %{STRING:messageId} %{STRING:message}
<%{INT:facilityPriority}>%{INT:version} %{INT:year}-%{INT:month}-%{INT:day}T%{INT:hour}:%{INT:minute}:%{INT:second}%{STRING:timezone} %{HOSTNAMEORIP:hostname} %{STRING:message}


# Cisco variant of RFC 3164 with year and colon after time
<%{INT:facilityPriority}> %{MONTH:month} %{INT:day} %{INT:year} %{INT:hour}:%{INT:minute}:%{INT:second}: %{STRING:message}


# Netgear variant of RFC 3164 with day of week and no hostname or process info
<%{INT:facilityPriority}> %{STRING:dayofweek}, %{INT:year}-%{INT:month}-%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} - %{STRING:message}

# Cisco syslog: https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html#wp1054470
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{NOSPACE:parmComponentId}:%{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction} : %{NOSPACE:processName}[%{INT:processId}]: %{STRING:message}
<%{INT:facilityPriority}>: %{INT:year} %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{STRING:timezone}: %{STRING:message}
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{STRING:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}: %{STRING:message}
<%{INT:facilityPriority}> %{INT:year} %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{STRING:timezone} *%{HOSTNAME:hostname}* %{STRING:message}
<%{INT:facilityPriority}> %{INT:year} %{MONTH:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second} %{STRING:timezone} %{STRING:message}

# see issue HZN-1504
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{CHAR:ignore}%{MONTH:month}%{WHITESPACE:ignore}%{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}: %{STRING:message}
<%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{CHAR:ignore}%{STRING:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}: %{STRING:message}

# Note: This pattern '%{STRING:message}' should always come last as it will greedily match anything. If a pattern is
# placed after this one it will never be matched since this pattern matches anything.
%{STRING:message}