# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
kiwi_iso = {

  plugin_version = "1.3.1"

  # 2007-01-25 - 1.1 - KBB - added support for repeated lines if Unix Syslog (one format only so far)
  #                          is logged to Kiwi Syslog
  # 2008-05-20 : 1.2 : gas : removed create_profile_wizard_options section - it should not
  #                           be done here for generic syslogs - if you need it, I recommend 
  #                           you add it to your plug-in
  #                          Added syslog_message_type field tracking
  # 2008-05-23 : 1.3 : gas : fixed a bug in the section that splits "Local7.Debug" type
  #                          entries into syslog_priority and syslog_message_type 
  #                          (it was getting them the wrong way round, and was not setting
  #                          syslog_priority at all, only v.syslog_priority)
  # 2011-04-04 - 1.3.1 - MSG - Edited info lines.

  info.1.manufacturer = "Solarwinds"
  info.1.device = "Kiwi Syslog (ISO/Sawmill)"
  info.1.version.1 = ""

  info.2.manufacturer = "Kiwi"
  info.2.device = "Syslog (ISO/Sawmill)"
  info.2.version.1 = ""

  # Kiwi Syslog (ISO/Sawmill)

  # The name of the log format
  log.format.format_label = "Kiwi Syslog (ISO/Sawmill)"
  log.miscellaneous.log_data_type = "syslog"  
  log.miscellaneous.log_format_type = "syslog_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9][ 	][0-9][0-9][:.][0-9][0-9][:.][0-9][0-9]	[^	]*	[^	]*	"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # The format of dates and times in this log
  log.format.date_format = "auto"
  log.format.time_format = "auto"

  log.format.ignore_format_lines = "true"

  # Log fields
  log.fields = {

    date.type = "date"
    time.type = "time"
    syslog_priority = ""
    logging_device = ""
    syslog_message = ""
    syslog_message_type = ""
 
  } # log.fields

  # At initialization time, get the last line from the previous build, in case we need it for
  # "repeated" lines. Note that repeated lines will only occur in Kiwi syslog if Unix Syslog is
  # logging to Kiwi.
  log.filter_initialization_syslog = `
string last_log_line_pathname = volatile.database_directory . "main" . internal.directory_divider . "last_log_line.txt";
string last_log_line;
if (file_exists(last_log_line_pathname)) then (
  last_log_line = read_file(last_log_line_pathname);
);
`

  # At finalization time, save the last line of this build.
  log.filter_finalization_syslog = `
write_file(last_log_line_pathname, last_log_line);
`


  #          
  # Log Parsing Filters
  log.parsing_filters = {

    syslog_parse = `
v.syslog_message = '';
if (matches_regular_expression(current_log_line(), '^([0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9])[ 	]([0-9][0-9][:.][0-9][0-9][:.][0-9][0-9])	([^	]*)	([^	]*)	(.*)$')) then (
  set_collected_field('', 'date', $1);
  set_collected_field('', 'time', $2);
  set_collected_field('', 'logging_device', $4);
  v.syslog_message = $5;

   # we need to check if we have a "Local7.Debug" type entry - this is two fields
   v.syslog_priority = $3;
   if (matches_regular_expression(v.syslog_priority, '^(.*)\\.(.*)$')) then (
    set_collected_field('', 'syslog_message_type', $1);
    set_collected_field('', 'syslog_priority', $2);
    );
   else (
     set_collected_field('', 'syslog_priority', v.syslog_priority);
    );


  #Dec 22 15:11:53 last message repeated 5 times
  # If this is a 'last message repeated' line, take the previous line and insert it into
  # the log data stream that many times. This message comes from unix syslog. This is only
  # one possible case of a syslog logging to another syslog.
  if (matches_regular_expression(v.syslog_message, '^[A-Za-z][A-Za-z][A-Za-z] [0-9 ]?[0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9] last message repeated ([0-9]+) times')) then (
    for (int i = 0; i < $1; i++) (
      set_subnode_value('volatile.log_line_insertions', i, last_log_line);
    )
  ); # if last message repeated
  else (
    # Remember the log line, in case we get a "last message repeated" line next.
    last_log_line = current_log_line();
  ); # if non-repeated line
  );
  `
  } # log.parsing_filters

  # Database fields
  database.fields = {
    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    logging_device = ""
    syslog_priority = ""
    syslog_message_type = ""
  } # database.fields
} # kiwi_iso