no_syslog = { # The name of the log format log.format.format_label = "No Syslog Header (use today's date, or use date/time from message)" log.miscellaneous.log_data_type = "syslog" log.miscellaneous.log_format_type = "syslog_server" # Don't autodetect this format log.format.autodetect_expression = "false" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" log.fields = { date = "" time = "" } # log.fields # Log Parsing Filters log.parsing_filters.parse_syslog = ` # Use today's date and the current time as the date/time v.date_time = epoc_to_date_time(now()); set_collected_field('', 'date', substr(v.date_time, 0, 11)); set_collected_field('', 'time', substr(v.date_time, 12, 8)); # Use the entire line as the syslog message v.syslog_message = current_log_line(); ` # Database fields database.fields = { date_time = "" } # database.fields create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" } # report_groups } # create_profile_wizard_options } # no_syslog