graylog_JunOS_SRX

{
  "extractors": [
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [
        {
          "type": "syslog_pri_facility",
          "config": {}
        }
      ],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "<(.\\d)>"
      },
      "extractor_type": "regex",
      "order": 2,
      "source_field": "message",
      "target_field": "facility",
      "title": "Get Syslog Facility"
    },
    {
      "condition_type": "string",
      "condition_value": "session",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "(\\d*)->"
      },
      "extractor_type": "regex",
      "order": 5,
      "source_field": "message",
      "target_field": "source_port",
      "title": "Source Port"
    },
    {
      "condition_type": "string",
      "condition_value": "session",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "->\\d*.\\d*.\\d*.\\d*/(\\d*)"
      },
      "extractor_type": "regex",
      "order": 7,
      "source_field": "message",
      "target_field": "destination_port",
      "title": "Destination Port"
    },
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "^(?:[^\\s]*\\s){5}([A-Z_]+)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "local_facility",
      "title": "Local Facility"
    },
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "^(?:[^\\s]*\\s){6}([A-Z_]+)"
      },
      "extractor_type": "regex",
      "order": 1,
      "source_field": "message",
      "target_field": "event",
      "title": "Event"
    },
    {
      "condition_type": "string",
      "condition_value": "session",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "->((?:[0-9]{1,3}\\.){3}[0-9]{1,3})"
      },
      "extractor_type": "regex",
      "order": 6,
      "source_field": "message",
      "target_field": "destination_ip",
      "title": "Destination IP"
    },
    {
      "condition_type": "string",
      "condition_value": "session",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "\\s((?:[0-9]{1,3}\\.){3}[0-9]{1,3})"
      },
      "extractor_type": "regex",
      "order": 4,
      "source_field": "message",
      "target_field": "source_ip",
      "title": "Source IP"
    }
  ],
  "version": "1.0.2 (e5432f1)"
}