#############################################################################
# Copyright (c) 2017 Balabit
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 2 as published
# by the Free Software Foundation, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
#
# As an additional exemption you are allowed to compile & link against the
# OpenSSL libraries as published by the OpenSSL project. See the file
# COPYING for details.
#
#############################################################################

#
# logging timestamps
# logging timezone
# logging sequence-id
# logging origin-id
# logging fraction of a second
#
#
# <pri>(sequence: )?(origin: )?(timestamp? timezone?: )?%msg

#<189>29: foo: *Apr 29 13:58:40.411: %SYS-5-CONFIG_I: Configured from console by console
#<190>30: foo: *Apr 29 13:58:46.411: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.1.239 stopped - CLI initiated
#<190>31: foo: *Apr 29 13:58:46.411: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.1.239 started - CLI initiated<189>32: 0.0.0.0: *Apr 29 13:59:12.491: %SYS-5-CONFIG_I: Configured from console by console<189>33: 0.0.0.0: *Apr 29 13:59:26.415: %SYS-5-CONFIG_I: Configured from console by console<189>34: 0.0.0.0: *Apr 29 13:59:56.603: %SYS-5-CONFIG_I: Configured from console by console^[[<189>35: *Apr 29 14:00:16.059: %SYS-5-CONFIG_I: Configured from console by console

#
# parses a cisco timestamp with explicit date-parser
# It ignores msec and year information
#
block parser cisco-timestamp-parser(template()) {
    channel {
        rewrite {
            set("`template`" value('1'));
	};
	junction {
	    # alternative #1, no year
	    channel {
                filter {
                    match('^[.*]?([A-Za-z]{3} [0-9 ]\d \d{2}:\d{2}:\d{2})' value('1') flags(store-matches));
                };
                parser {
                    date-parser(format('%b %d %H:%M:%S') template("$1"));
                };
		flags(final);
	    };

	    channel {
                filter {
                    match('^[.*]?([A-Za-z]{3} [0-9 ]\d \d{4} \d{2}:\d{2}:\d{2})' value('1') flags(store-matches));
                };
                parser {
                    date-parser(format('%b %d %Y %H:%M:%S') template("$1"));
                };
		flags(final);
	    };
        };
        rewrite {
            unset(value('1'));
        };
    };
};

block parser cisco-parser() {
    channel {
        parser {
            # split msg and header right before the '%', Cisco messages may
            # have a variable number of ': ' terminated values
            csv-parser(delimiters(chars('') strings(': %'))
                       columns('1', '2', '3') flags(greedy, drop-invalid));

            csv-parser(delimiters(chars(':')) template("$2") columns('3'));
            csv-parser(delimiters(chars('-')) template("$3")
                       columns('.cisco.facility', '.cisco.severity', '.cisco.mnemonic'));
        };
        rewrite {
            set('%$2', value("MSG"));

	    # drop "<pri>seqno: " if present
            subst("^(<[0-9]+>)?([0-9]+)?(: )?", "", value('1'));

        };

	junction {
            channel {
                parser {
                    cisco-timestamp-parser(template("$1"));
                };
                flags(final);
            };
            channel {
                filter {
                    match("^(?'HOST'[^:]+): (.*)" value('1') flags(store-matches) type(pcre));
                };
                parser {
                    cisco-timestamp-parser(template("$2"));
                };
                flags(final);
            };

            channel {
                filter {
                    match("^(?'HOST'[^:]+)$" value('1') flags(store-matches) type(pcre));
                };
                flags(final);
            };
            channel {
                filter {
                    match("^$" value('1') flags(store-matches) type(pcre));
                };
                flags(final);
            };
        };
        rewrite {
            unset(value("1"));
            unset(value("2"));
            unset(value("3"));
        };
    };
};
