graylog_UniFi

{
  "extractors": [
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [
        {
          "type": "syslog_pri_facility",
          "config": {}
        }
      ],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "<(.\\d)>"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "facility",
      "title": "Syslog Facility"
    },
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "STA\\s(..:..:..:..:..:..)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "client_mac",
      "title": "Client MAC address"
    },
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "^(?:[^\\s]*\\s){5}([a-z]+)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "local_facility",
      "title": "Local Facility"
    },
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "for\\s(..:..:..:..:..:..)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "client_mac",
      "title": "Client MAC address 2"
    },
    {
      "condition_type": "none",
      "condition_value": "",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "2.11:\\s(.+)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "assoc_status",
      "title": "802.11 Association Status"
    },
    {
      "condition_type": "string",
      "condition_value": "kernel",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "other\\ssignal\\s(\\d+)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "client_signal",
      "title": "Client Signal"
    },
    {
      "condition_type": "string",
      "condition_value": "kernel",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": "our\\ssignal\\s(\\d+)"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "message",
      "target_field": "wap_signal",
      "title": "WAP Signal Level"
    }
  ],
  "version": "1.0.2 (e5432f1)"
}