Initial commit

vendor/github.com/vjeantet/grok/.gitignore

@@ -0,0 +1,30 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
+*.cov
+.coveralls.yml
+# added by GitSavvy
+.DS_Store
+.idea
+*.i*

vendor/github.com/vjeantet/grok/.travis.yml

@@ -0,0 +1,10 @@
+language: go
+language: go
+install:
+    - go get -v golang.org/x/tools/cmd/cover
+script:
+    - go test -v -tags=testcgo -covermode=count -coverprofile=profile.cov
+after_success:
+    - go get -v github.com/mattn/goveralls
+    - export PATH=$PATH:$HOME/gopath/bin
+    - goveralls -coverprofile=profile.cov -service=travis-ci

vendor/github.com/vjeantet/grok/BUILD

@@ -0,0 +1,46 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+    "go_library",
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "graph_test.go",
+        "grok_test.go",
+    ],
+    embed = [":go_default_library"],
+    tags = ["automanaged"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "graph.go",
+        "grok.go",
+        "patterns.go",
+    ],
+    importpath = "github.com/vjeantet/grok",
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//vendor/github.com/vjeantet/grok/example:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/vjeantet/grok/LICENSE

@@ -0,0 +1,202 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

vendor/github.com/vjeantet/grok/README.md

@@ -0,0 +1,123 @@
+[![GoDoc](https://godoc.org/github.com/vjeantet/grok?status.svg)](https://godoc.org/github.com/vjeantet/grok)
+[![Build Status](https://travis-ci.org/vjeantet/grok.svg)](https://travis-ci.org/vjeantet/grok)
+[![Coverage Status](https://coveralls.io/repos/vjeantet/grok/badge.png?branch=master)](https://coveralls.io/r/vjeantet/grok?branch=master)
+[![Go Report Card](http://goreportcard.com/badge/vjeantet/grok)](http:/goreportcard.com/report/vjeantet/grok)
+[![Documentation Status](https://readthedocs.org/projects/grok-lib-for-golang/badge/?version=latest)](https://readthedocs.org/projects/grok-lib-for-golang/?badge=latest)
+
+
+# grok
+A simple library to parse grok patterns with Go.
+
+# Installation
+Make sure you have a working Go environment.
+
+```sh
+go get github.com/vjeantet/grok
+```
+
+# Use in your project
+```go
+import "github.com/vjeantet/grok"
+```
+
+# Usage
+## Available patterns and custom ones
+By default this grok package contains only patterns you can see in patterns/grok-patterns file.
+
+When you want to add a custom pattern, use the grok.AddPattern(nameOfPattern, pattern), see the example folder for an example of usage.
+You also can load your custom patterns from a file (or folder) using grok.AddPatternsFromPath(path), or PatterndDir configuration.
+
+## Parse all or only named captures
+```go
+g, _ := grok.New()
+values, _  := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+
+g, _ = grok.NewWithConfig(&grok.Config{NamedCapturesOnly: true})
+values2, _ := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+```
+values is a map with all captured groups
+values2 contains only named captures
+
+# Examples
+```go
+package main
+
+import (
+	"fmt"
+
+	"github.com/vjeantet/grok"
+)
+
+func main() {
+	g, _ := grok.New()
+	values, _ := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+
+	for k, v := range values {
+		fmt.Printf("%+15s: %s\n", k, v)
+	}
+}
+```
+
+output:
+```
+       response: 404
+          bytes: 207
+       HOSTNAME: 127.0.0.1
+       USERNAME: -
+       MONTHDAY: 23
+        request: /index.php
+      BASE10NUM: 207
+           IPV6:
+           auth: -
+      timestamp: 23/Apr/2014:22:58:32 +0200
+           verb: GET
+    httpversion: 1.1
+           TIME: 22:58:32
+           HOUR: 22
+COMMONAPACHELOG: 127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207
+       clientip: 127.0.0.1
+             IP:
+          ident: -
+          MONTH: Apr
+           YEAR: 2014
+         SECOND: 32
+            INT: +0200
+           IPV4:
+         MINUTE: 58
+     rawrequest:
+```
+
+# Example 2
+```go
+package main
+
+import (
+  "fmt"
+
+  "github.com/vjeantet/grok"
+)
+
+func main() {
+  g, _ := grok.NewWithConfig(&grok.Config{NamedCapturesOnly: true})
+  values, _ := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+
+  for k, v := range values {
+    fmt.Printf("%+15s: %s\n", k, v)
+  }
+}
+```
+
+output:
+```
+      timestamp: 23/Apr/2014:22:58:32 +0200
+           verb: GET
+     rawrequest:
+          bytes: 207
+           auth: -
+        request: /index.php
+    httpversion: 1.1
+       response: 404
+COMMONAPACHELOG: 127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207
+       clientip: 127.0.0.1
+          ident: -
+```

vendor/github.com/vjeantet/grok/example/BUILD

@@ -0,0 +1,36 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+)
+
+go_binary(
+    name = "example",
+    embed = [":go_default_library"],
+    tags = ["automanaged"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "github.com/vjeantet/grok/example",
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+    deps = ["//vendor/github.com/vjeantet/grok:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/vjeantet/grok/example/main.go

@@ -0,0 +1,34 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/vjeantet/grok"
+)
+
+func main() {
+	fmt.Println("# Default Capture :")
+	g, _ := grok.New()
+	values, _ := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	for k, v := range values {
+		fmt.Printf("%+15s: %s\n", k, v)
+	}
+
+	fmt.Println("\n# Named Capture :")
+	g, _ = grok.NewWithConfig(&grok.Config{NamedCapturesOnly: true})
+	values, _ = g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	for k, v := range values {
+		fmt.Printf("%+15s: %s\n", k, v)
+	}
+
+	fmt.Println("\n# Add custom patterns :")
+	// We add 3 patterns to our Grok instance, to structure an IRC message
+	g, _ = grok.NewWithConfig(&grok.Config{NamedCapturesOnly: true})
+	g.AddPattern("IRCUSER", `\A@(\w+)`)
+	g.AddPattern("IRCBODY", `.*`)
+	g.AddPattern("IRCMSG", `%{IRCUSER:user} .* : %{IRCBODY:message}`)
+	values, _ = g.Parse("%{IRCMSG}", `@vjeantet said : Hello !`)
+	for k, v := range values {
+		fmt.Printf("%+15s: %s\n", k, v)
+	}
+}

vendor/github.com/vjeantet/grok/graph.go

@@ -0,0 +1,58 @@
+package grok
+
+type graph map[string][]string
+
+func reverseList(s []string) (r []string) {
+	for _, i := range s {
+		i := i
+		defer func() { r = append(r, i) }()
+	}
+	return
+}
+
+func sortGraph(g graph) (order, cyclic []string) {
+	L := make([]string, len(g))
+	i := len(L)
+	temp := map[string]bool{}
+	perm := map[string]bool{}
+	var cycleFound bool
+	var cycleStart string
+	var visit func(string)
+	visit = func(n string) {
+		switch {
+		case temp[n]:
+			cycleFound = true
+			cycleStart = n
+			return
+		case perm[n]:
+			return
+		}
+		temp[n] = true
+		for _, m := range g[n] {
+			visit(m)
+			if cycleFound {
+				if cycleStart > "" {
+					cyclic = append(cyclic, n)
+					if n == cycleStart {
+						cycleStart = ""
+					}
+				}
+				return
+			}
+		}
+		delete(temp, n)
+		perm[n] = true
+		i--
+		L[i] = n
+	}
+	for n := range g {
+		if perm[n] {
+			continue
+		}
+		visit(n)
+		if cycleFound {
+			return nil, cyclic
+		}
+	}
+	return L, nil
+}

vendor/github.com/vjeantet/grok/graph_test.go

@@ -0,0 +1,91 @@
+package grok
+
+import "testing"
+
+func TestReverseList(t *testing.T) {
+	var array = []string{"A", "B", "C", "D"}
+	var expectedArray = []string{"D", "C", "B", "A"}
+	arrayReversed := reverseList(array)
+	if !sliceEquals(arrayReversed, expectedArray) {
+		t.Fatalf("reversedList is %+v, expected : %+v", arrayReversed, expectedArray)
+	}
+}
+
+func TestSortGraph(t *testing.T) {
+	var g = graph{}
+	g["7"] = []string{"11", "8"}
+	g["5"] = []string{"11"}
+	g["3"] = []string{"8", "10"}
+	g["11"] = []string{"2", "9", "10"}
+	g["8"] = []string{"9", "10"}
+	g["2"] = []string{}
+	g["9"] = []string{}
+	g["10"] = []string{}
+
+	validOrders := [][]string{
+		{"3", "5", "7", "8", "11", "10", "9", "2"},
+		{"3", "5", "7", "8", "11", "2", "10", "9"},
+		{"3", "5", "7", "8", "11", "9", "2", "10"},
+		{"7", "3", "8", "5", "11", "10", "9", "2"},
+		{"3", "5", "7", "11", "2", "8", "10", "9"},
+		{"5", "7", "11", "2", "3", "8", "10", "9"},
+	}
+
+	order, cycle := sortGraph(g)
+	if cycle != nil {
+		t.Fatal("cycle detected while not expected")
+	}
+	for _, expectedOrder := range validOrders {
+		if sliceEquals(order, expectedOrder) {
+			return
+		}
+	}
+
+	t.Fatalf("sorted graph is %+v, expected a order like: %+v", order, validOrders[0])
+}
+
+func TestSortGraphWithCycle(t *testing.T) {
+	var g = graph{}
+	g["7"] = []string{"11", "8"}
+	g["5"] = []string{"11"}
+	g["3"] = []string{"8", "10"}
+	g["11"] = []string{"2", "9", "10"}
+	g["8"] = []string{"9", "10"}
+	g["2"] = []string{}
+	g["9"] = []string{"3"}
+	g["10"] = []string{}
+
+	validCycles := [][]string{
+		{"3", "9", "8"},
+		{"8", "3", "9"},
+		{"9", "8", "3"},
+	}
+
+	_, cycle := sortGraph(g)
+
+	if cycle == nil {
+		t.Fatal("cycle not detected while sorting graph")
+	}
+
+	for _, expectedCycle := range validCycles {
+		if sliceEquals(cycle, expectedCycle) {
+			return
+		}
+	}
+
+	t.Fatalf("cycle have %+v, expected %+v", cycle, validCycles[0])
+}
+
+func sliceEquals(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+
+	return true
+}

vendor/github.com/vjeantet/grok/grok.go

@@ -0,0 +1,414 @@
+package grok
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+var (
+	canonical = regexp.MustCompile(`%{(\w+(?::\w+(?::\w+)?)?)}`)
+	normal    = regexp.MustCompile(`%{([\w-.]+(?::[\w-.]+(?::[\w-.]+)?)?)}`)
+	symbolic  = regexp.MustCompile(`\W`)
+)
+
+// A Config structure is used to configure a Grok parser.
+type Config struct {
+	NamedCapturesOnly   bool
+	SkipDefaultPatterns bool
+	RemoveEmptyValues   bool
+	PatternsDir         []string
+	Patterns            map[string]string
+}
+
+// Grok object us used to load patterns and deconstruct strings using those
+// patterns.
+type Grok struct {
+	rawPattern       map[string]string
+	config           *Config
+	aliases          map[string]string
+	compiledPatterns map[string]*gRegexp
+	patterns         map[string]*gPattern
+	patternsGuard    *sync.RWMutex
+	compiledGuard    *sync.RWMutex
+}
+
+type gPattern struct {
+	expression string
+	typeInfo   semanticTypes
+}
+
+type gRegexp struct {
+	regexp   *regexp.Regexp
+	typeInfo semanticTypes
+}
+
+type semanticTypes map[string]string
+
+// New returns a Grok object.
+func New() (*Grok, error) {
+	return NewWithConfig(&Config{})
+}
+
+// NewWithConfig returns a Grok object that is configured to behave according
+// to the supplied Config structure.
+func NewWithConfig(config *Config) (*Grok, error) {
+	g := &Grok{
+		config:           config,
+		aliases:          map[string]string{},
+		compiledPatterns: map[string]*gRegexp{},
+		patterns:         map[string]*gPattern{},
+		rawPattern:       map[string]string{},
+		patternsGuard:    new(sync.RWMutex),
+		compiledGuard:    new(sync.RWMutex),
+	}
+
+	if !config.SkipDefaultPatterns {
+		g.AddPatternsFromMap(patterns)
+	}
+
+	if len(config.PatternsDir) > 0 {
+		for _, path := range config.PatternsDir {
+			err := g.AddPatternsFromPath(path)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+	}
+
+	if err := g.AddPatternsFromMap(config.Patterns); err != nil {
+		return nil, err
+	}
+
+	return g, nil
+}
+
+// AddPattern adds a new pattern to the list of loaded patterns.
+func (g *Grok) addPattern(name, pattern string) error {
+	dnPattern, ti, err := g.denormalizePattern(pattern, g.patterns)
+	if err != nil {
+		return err
+	}
+
+	g.patterns[name] = &gPattern{expression: dnPattern, typeInfo: ti}
+	return nil
+}
+
+// AddPattern adds a named pattern to grok
+func (g *Grok) AddPattern(name, pattern string) error {
+	g.patternsGuard.Lock()
+	defer g.patternsGuard.Unlock()
+
+	g.rawPattern[name] = pattern
+	g.buildPatterns()
+	return nil
+}
+
+// AddPatternsFromMap loads a map of named patterns
+func (g *Grok) AddPatternsFromMap(m map[string]string) error {
+	g.patternsGuard.Lock()
+	defer g.patternsGuard.Unlock()
+
+	for name, pattern := range m {
+		g.rawPattern[name] = pattern
+	}
+	return g.buildPatterns()
+}
+
+// AddPatternsFromMap adds new patterns from the specified map to the list of
+// loaded patterns.
+func (g *Grok) addPatternsFromMap(m map[string]string) error {
+	patternDeps := graph{}
+	for k, v := range m {
+		keys := []string{}
+		for _, key := range canonical.FindAllStringSubmatch(v, -1) {
+			names := strings.Split(key[1], ":")
+			syntax := names[0]
+			if g.patterns[syntax] == nil {
+				if _, ok := m[syntax]; !ok {
+					return fmt.Errorf("no pattern found for %%{%s}", syntax)
+				}
+			}
+			keys = append(keys, syntax)
+		}
+		patternDeps[k] = keys
+	}
+	order, _ := sortGraph(patternDeps)
+	for _, key := range reverseList(order) {
+		g.addPattern(key, m[key])
+	}
+
+	return nil
+}
+
+// AddPatternsFromPath adds new patterns from the files in the specified
+// directory to the list of loaded patterns.
+func (g *Grok) AddPatternsFromPath(path string) error {
+	if fi, err := os.Stat(path); err == nil {
+		if fi.IsDir() {
+			path = path + "/*"
+		}
+	} else {
+		return fmt.Errorf("invalid path : %s", path)
+	}
+
+	// only one error can be raised, when pattern is malformed
+	// pattern is hard-coded "/*" so we ignore err
+	files, _ := filepath.Glob(path)
+
+	var filePatterns = map[string]string{}
+	for _, fileName := range files {
+		file, err := os.Open(fileName)
+		if err != nil {
+			return err
+		}
+
+		scanner := bufio.NewScanner(bufio.NewReader(file))
+
+		for scanner.Scan() {
+			l := scanner.Text()
+			if len(l) > 0 && l[0] != '#' {
+				names := strings.SplitN(l, " ", 2)
+				filePatterns[names[0]] = names[1]
+			}
+		}
+
+		file.Close()
+	}
+
+	return g.AddPatternsFromMap(filePatterns)
+}
+
+// Match returns true if the specified text matches the pattern.
+func (g *Grok) Match(pattern, text string) (bool, error) {
+	gr, err := g.compile(pattern)
+	if err != nil {
+		return false, err
+	}
+
+	if ok := gr.regexp.MatchString(text); !ok {
+		return false, nil
+	}
+
+	return true, nil
+}
+
+// compiledParse parses the specified text and returns a map with the results.
+func (g *Grok) compiledParse(gr *gRegexp, text string) (map[string]string, error) {
+	captures := make(map[string]string)
+	if match := gr.regexp.FindStringSubmatch(text); len(match) > 0 {
+		for i, name := range gr.regexp.SubexpNames() {
+			if name != "" {
+				if g.config.RemoveEmptyValues && match[i] == "" {
+					continue
+				}
+				name = g.nameToAlias(name)
+				captures[name] = match[i]
+			}
+		}
+	}
+
+	return captures, nil
+}
+
+// Parse the specified text and return a map with the results.
+func (g *Grok) Parse(pattern, text string) (map[string]string, error) {
+	gr, err := g.compile(pattern)
+	if err != nil {
+		return nil, err
+	}
+
+	return g.compiledParse(gr, text)
+}
+
+// ParseTyped returns a inteface{} map with typed captured fields based on provided pattern over the text
+func (g *Grok) ParseTyped(pattern string, text string) (map[string]interface{}, error) {
+	gr, err := g.compile(pattern)
+	if err != nil {
+		return nil, err
+	}
+	match := gr.regexp.FindStringSubmatch(text)
+	captures := make(map[string]interface{})
+	if len(match) > 0 {
+		for i, segmentName := range gr.regexp.SubexpNames() {
+			if len(segmentName) != 0 {
+				if g.config.RemoveEmptyValues == true && match[i] == "" {
+					continue
+				}
+				name := g.nameToAlias(segmentName)
+				if segmentType, ok := gr.typeInfo[segmentName]; ok {
+					switch segmentType {
+					case "int":
+						captures[name], _ = strconv.Atoi(match[i])
+					case "float":
+						captures[name], _ = strconv.ParseFloat(match[i], 64)
+					default:
+						return nil, fmt.Errorf("ERROR the value %s cannot be converted to %s", match[i], segmentType)
+					}
+				} else {
+					captures[name] = match[i]
+				}
+			}
+
+		}
+	}
+
+	return captures, nil
+}
+
+// ParseToMultiMap parses the specified text and returns a map with the
+// results. Values are stored in an string slice, so values from captures with
+// the same name don't get overridden.
+func (g *Grok) ParseToMultiMap(pattern, text string) (map[string][]string, error) {
+	gr, err := g.compile(pattern)
+	if err != nil {
+		return nil, err
+	}
+
+	captures := make(map[string][]string)
+	if match := gr.regexp.FindStringSubmatch(text); len(match) > 0 {
+		for i, name := range gr.regexp.SubexpNames() {
+			if name != "" {
+				if g.config.RemoveEmptyValues == true && match[i] == "" {
+					continue
+				}
+				name = g.nameToAlias(name)
+				captures[name] = append(captures[name], match[i])
+			}
+		}
+	}
+
+	return captures, nil
+}
+
+func (g *Grok) buildPatterns() error {
+	g.patterns = map[string]*gPattern{}
+	return g.addPatternsFromMap(g.rawPattern)
+}
+
+func (g *Grok) compile(pattern string) (*gRegexp, error) {
+	g.compiledGuard.RLock()
+	gr, ok := g.compiledPatterns[pattern]
+	g.compiledGuard.RUnlock()
+
+	if ok {
+		return gr, nil
+	}
+
+	g.patternsGuard.RLock()
+	newPattern, ti, err := g.denormalizePattern(pattern, g.patterns)
+	g.patternsGuard.RUnlock()
+	if err != nil {
+		return nil, err
+	}
+
+	compiledRegex, err := regexp.Compile(newPattern)
+	if err != nil {
+		return nil, err
+	}
+	gr = &gRegexp{regexp: compiledRegex, typeInfo: ti}
+
+	g.compiledGuard.Lock()
+	g.compiledPatterns[pattern] = gr
+	g.compiledGuard.Unlock()
+
+	return gr, nil
+}
+
+func (g *Grok) denormalizePattern(pattern string, storedPatterns map[string]*gPattern) (string, semanticTypes, error) {
+	ti := semanticTypes{}
+	for _, values := range normal.FindAllStringSubmatch(pattern, -1) {
+		names := strings.Split(values[1], ":")
+
+		syntax, semantic, alias := names[0], names[0], names[0]
+		if len(names) > 1 {
+			semantic = names[1]
+			alias = g.aliasizePatternName(semantic)
+		}
+
+		// Add type cast information only if type set, and not string
+		if len(names) == 3 {
+			if names[2] != "string" {
+				ti[semantic] = names[2]
+			}
+		}
+
+		storedPattern, ok := storedPatterns[syntax]
+		if !ok {
+			return "", ti, fmt.Errorf("no pattern found for %%{%s}", syntax)
+		}
+
+		var buffer bytes.Buffer
+		if !g.config.NamedCapturesOnly || (g.config.NamedCapturesOnly && len(names) > 1) {
+			buffer.WriteString("(?P<")
+			buffer.WriteString(alias)
+			buffer.WriteString(">")
+			buffer.WriteString(storedPattern.expression)
+			buffer.WriteString(")")
+		} else {
+			buffer.WriteString("(")
+			buffer.WriteString(storedPattern.expression)
+			buffer.WriteString(")")
+		}
+
+		//Merge type Informations
+		for k, v := range storedPattern.typeInfo {
+			//Lastest type information is the one to keep in memory
+			if _, ok := ti[k]; !ok {
+				ti[k] = v
+			}
+		}
+
+		pattern = strings.Replace(pattern, values[0], buffer.String(), -1)
+	}
+
+	return pattern, ti, nil
+
+}
+
+func (g *Grok) aliasizePatternName(name string) string {
+	alias := symbolic.ReplaceAllString(name, "_")
+	g.aliases[alias] = name
+	return alias
+}
+
+func (g *Grok) nameToAlias(name string) string {
+	alias, ok := g.aliases[name]
+	if ok {
+		return alias
+	}
+	return name
+}
+
+// ParseStream will match the given pattern on a line by line basis from the reader
+// and apply the results to the process function
+func (g *Grok) ParseStream(reader *bufio.Reader, pattern string, process func(map[string]string) error) error {
+	gr, err := g.compile(pattern)
+	if err != nil {
+		return err
+	}
+	for {
+		line, err := reader.ReadString('\n')
+		if err == io.EOF {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		values, err := g.compiledParse(gr, line)
+		if err != nil {
+			return err
+		}
+		if err = process(values); err != nil {
+			return err
+		}
+	}
+}

vendor/github.com/vjeantet/grok/grok_test.go

@@ -0,0 +1,738 @@
+package grok
+
+import (
+	"bufio"
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestNew(t *testing.T) {
+	g, _ := New()
+	if len(g.patterns) == 0 {
+		t.Fatal("the Grok object should have some patterns pre loaded")
+	}
+
+	g, _ = NewWithConfig(&Config{NamedCapturesOnly: true})
+	if len(g.patterns) == 0 {
+		t.Fatal("the Grok object should have some patterns pre loaded")
+	}
+}
+
+func TestParseWithDefaultCaptureMode(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	if captures, err := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["timestamp"] != "23/Apr/2014:22:58:32 +0200" {
+			t.Fatalf("%s should be '%s' have '%s'", "timestamp", "23/Apr/2014:22:58:32 +0200", captures["timestamp"])
+		}
+		if captures["TIME"] != "" {
+			t.Fatalf("%s should be '%s' have '%s'", "TIME", "", captures["TIME"])
+		}
+	}
+
+	g, _ = New()
+	if captures, err := g.Parse("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["timestamp"] != "23/Apr/2014:22:58:32 +0200" {
+			t.Fatalf("%s should be '%s' have '%s'", "timestamp", "23/Apr/2014:22:58:32 +0200", captures["timestamp"])
+		}
+		if captures["TIME"] != "22:58:32" {
+			t.Fatalf("%s should be '%s' have '%s'", "TIME", "22:58:32", captures["TIME"])
+		}
+	}
+}
+
+func TestMultiParseWithDefaultCaptureMode(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	res, _ := g.ParseToMultiMap("%{COMMONAPACHELOG} %{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:23:58:32 +0200] "GET /index.php HTTP/1.1" 404 207 127.0.0.1 - - [24/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	if len(res["TIME"]) != 0 {
+		t.Fatalf("DAY should be an array of 0 elements, but is '%s'", res["TIME"])
+	}
+
+	g, _ = New()
+	res, _ = g.ParseToMultiMap("%{COMMONAPACHELOG} %{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:23:58:32 +0200] "GET /index.php HTTP/1.1" 404 207 127.0.0.1 - - [24/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	if len(res["TIME"]) != 2 {
+		t.Fatalf("TIME should be an array of 2 elements, but is '%s'", res["TIME"])
+	}
+	if len(res["timestamp"]) != 2 {
+		t.Fatalf("timestamp should be an array of 2 elements, but is '%s'", res["timestamp"])
+	}
+}
+
+func TestNewWithNoDefaultPatterns(t *testing.T) {
+	g, _ := NewWithConfig(&Config{SkipDefaultPatterns: true})
+	if len(g.patterns) != 0 {
+		t.Fatal("Using SkipDefaultPatterns the Grok object should not have any patterns pre loaded")
+	}
+}
+
+func TestAddPatternErr(t *testing.T) {
+	name := "Error"
+	pattern := "%{ERR}"
+
+	g, _ := New()
+	err := g.addPattern(name, pattern)
+	if err == nil {
+		t.Fatalf("AddPattern should returns an error when path is invalid")
+	}
+}
+
+func TestAddPatternsFromPathErr(t *testing.T) {
+	g, _ := New()
+	err := g.AddPatternsFromPath("./Lorem ipsum Minim qui in.")
+	if err == nil {
+		t.Fatalf("AddPatternsFromPath should returns an error when path is invalid")
+	}
+}
+
+func TestConfigPatternsDir(t *testing.T) {
+	g, err := NewWithConfig(&Config{PatternsDir: []string{"./patterns"}})
+	if err != nil {
+		t.Error(err)
+	}
+
+	if captures, err := g.Parse("%{SYSLOGLINE}", `Sep 12 23:19:02 docker syslog-ng[25389]: syslog-ng starting up; version='3.5.3'`); err != nil {
+		t.Fatalf("error : %s", err.Error())
+	} else {
+		// pp.Print(captures)
+		if captures["program"] != "syslog-ng" {
+			t.Fatalf("%s should be '%s' have '%s'", "program", "syslog-ng", captures["program"])
+		}
+	}
+
+}
+
+func TestAddPatternsFromPathFileOpenErr(t *testing.T) {
+	t.Skipped()
+}
+
+func TestAddPatternsFromPathFile(t *testing.T) {
+	g, _ := New()
+	err := g.AddPatternsFromPath("./patterns/grok-patterns")
+	if err != nil {
+		t.Fatalf("err %#v", err)
+	}
+}
+
+func TestAddPattern(t *testing.T) {
+	name := "DAYO"
+	pattern := "(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)"
+
+	g, _ := New()
+	cPatterns := len(g.patterns)
+	g.AddPattern(name, pattern)
+	g.AddPattern(name+"2", pattern)
+	if len(g.patterns) != cPatterns+2 {
+		t.Fatalf("%d Default patterns should be available, have %d", cPatterns+2, len(g.patterns))
+	}
+
+	g, _ = NewWithConfig(&Config{NamedCapturesOnly: true})
+	cPatterns = len(g.patterns)
+	g.AddPattern(name, pattern)
+	g.AddPattern(name+"2", pattern)
+	if len(g.patterns) != cPatterns+2 {
+		t.Fatalf("%d NamedCapture patterns should be available, have %d", cPatterns+2, len(g.patterns))
+	}
+}
+
+func TestMatch(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+
+	if r, err := g.Match("%{MONTH}", "June"); !r {
+		t.Fatalf("June should match %s: err=%s", "%{MONTH}", err.Error())
+	}
+
+}
+func TestDoesNotMatch(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+	if r, _ := g.Match("%{MONTH}", "13"); r {
+		t.Fatalf("13 should not match %s", "%{MONTH}")
+	}
+}
+
+func TestErrorMatch(t *testing.T) {
+	g, _ := New()
+	if _, err := g.Match("(", "13"); err == nil {
+		t.Fatal("Error expected")
+	}
+
+}
+
+func TestShortName(t *testing.T) {
+	g, _ := New()
+	g.AddPattern("A", "a")
+
+	m, err := g.Match("%{A}", "a")
+	if err != nil {
+		t.Fatal("a should match %%{A}: err=%s", err.Error())
+	}
+	if !m {
+		t.Fatal("%%{A} didn't match 'a'")
+	}
+}
+
+func TestDayCompile(t *testing.T) {
+	g, _ := New()
+	g.AddPattern("DAY", "(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)")
+	pattern := "%{DAY}"
+	_, err := g.compile(pattern)
+	if err != nil {
+		t.Fatal("Error:", err)
+	}
+}
+
+func TestErrorCompile(t *testing.T) {
+	g, _ := New()
+	_, err := g.compile("(")
+	if err == nil {
+		t.Fatal("Error:", err)
+	}
+}
+
+func TestNamedCaptures(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+
+	check := func(key, value, pattern, text string) {
+		captures, _ := g.Parse(pattern, text)
+		if captures[key] != value {
+			t.Fatalf("%s should be '%s' have '%s'", key, value, captures[key])
+		}
+	}
+
+	check("jour", "Tue",
+		"%{DAY:jour}",
+		"Tue May 15 11:21:42 [conn1047685] moveChunk deleted: 7157",
+	)
+
+	check("day-of.week", "Tue",
+		"%{DAY:day-of.week}",
+		"Tue May 15 11:21:42 [conn1047685] moveChunk deleted: 7157",
+	)
+}
+
+func TestErrorCaptureUnknowPattern(t *testing.T) {
+	g, _ := New()
+	pattern := "%{UNKNOWPATTERN}"
+	_, err := g.Parse(pattern, "")
+	if err == nil {
+		t.Fatal("Expected error not set")
+	}
+}
+
+func TestParse(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+	res, _ := g.Parse("%{DAY}", "Tue qds")
+	if res["DAY"] != "Tue" {
+		t.Fatalf("DAY should be 'Tue' have '%s'", res["DAY"])
+	}
+}
+
+func TestErrorParseToMultiMap(t *testing.T) {
+	g, _ := New()
+	pattern := "%{UNKNOWPATTERN}"
+	_, err := g.ParseToMultiMap(pattern, "")
+	if err == nil {
+		t.Fatal("Expected error not set")
+	}
+}
+
+func TestParseToMultiMap(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+	res, _ := g.ParseToMultiMap("%{COMMONAPACHELOG} %{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:23:58:32 +0200] "GET /index.php HTTP/1.1" 404 207 127.0.0.1 - - [24/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	if len(res["TIME"]) != 2 {
+		t.Fatalf("DAY should be an array of 3 elements, but is '%s'", res["TIME"])
+	}
+	if res["TIME"][0] != "23:58:32" {
+		t.Fatalf("TIME[0] should be '23:58:32' have '%s'", res["TIME"][0])
+	}
+	if res["TIME"][1] != "22:58:32" {
+		t.Fatalf("TIME[1] should be '22:58:32' have '%s'", res["TIME"][1])
+	}
+}
+
+func TestParseToMultiMapOnlyNamedCaptures(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	g.AddPatternsFromPath("./patterns")
+	res, _ := g.ParseToMultiMap("%{COMMONAPACHELOG} %{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207 127.0.0.1 - - [24/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	if len(res["timestamp"]) != 2 {
+		t.Fatalf("timestamp should be an array of 2 elements, but is '%s'", res["timestamp"])
+	}
+	if res["timestamp"][0] != "23/Apr/2014:22:58:32 +0200" {
+		t.Fatalf("timestamp[0] should be '23/Apr/2014:22:58:32 +0200' have '%s'", res["DAY"][0])
+	}
+	if res["timestamp"][1] != "24/Apr/2014:22:58:32 +0200" {
+		t.Fatalf("timestamp[1] should be '24/Apr/2014:22:58:32 +0200' have '%s'", res["DAY"][1])
+	}
+}
+
+func TestCaptureAll(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+
+	check := func(key, value, pattern, text string) {
+
+		if captures, err := g.Parse(pattern, text); err != nil {
+			t.Fatalf("error can not capture : %s", err.Error())
+		} else {
+			if captures[key] != value {
+				t.Fatalf("%s should be '%s' have '%s'", key, value, captures[key])
+			}
+		}
+	}
+
+	check("timestamp", "23/Apr/2014:22:58:32 +0200",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("TIME", "22:58:32",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("SECOND", `17,1599`, "%{TIMESTAMP_ISO8601}", `s d9fq4999s ../ sdf 2013-11-06 04:50:17,1599sd`)
+	check("HOSTNAME", `google.com`, "%{HOSTPORT}", `google.com:8080`)
+	//HOSTPORT
+	check("POSINT", `8080`, "%{HOSTPORT}", `google.com:8080`)
+}
+
+func TestNamedCapture(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	g.AddPatternsFromPath("./patterns")
+
+	check := func(key, value, pattern, text string) {
+		if captures, err := g.Parse(pattern, text); err != nil {
+			t.Fatalf("error can not capture : %s", err.Error())
+		} else {
+			if captures[key] != value {
+				t.Fatalf("%s should be '%s' have '%s'", key, value, captures[key])
+			}
+		}
+	}
+
+	check("timestamp", "23/Apr/2014:22:58:32 +0200",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("TIME", "",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("SECOND", ``, "%{TIMESTAMP_ISO8601}", `s d9fq4999s ../ sdf 2013-11-06 04:50:17,1599sd`)
+	check("HOSTNAME", ``, "%{HOSTPORT}", `google.com:8080`)
+	//HOSTPORT
+	check("POSINT", ``, "%{HOSTPORT}", `google.com:8080`)
+}
+
+func TestRemoveEmptyValues(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true, RemoveEmptyValues: true})
+
+	capturesExists := func(key, pattern, text string) {
+		if captures, err := g.Parse(pattern, text); err != nil {
+			t.Fatalf("error can not capture : %s", err.Error())
+		} else {
+			if _, ok := captures[key]; ok {
+				t.Fatalf("%s should be absent", key)
+			}
+		}
+	}
+
+	capturesExists("rawrequest", "%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+
+}
+
+func TestCapturesAndNamedCapture(t *testing.T) {
+
+	check := func(key, value, pattern, text string) {
+		g, _ := New()
+		if captures, err := g.Parse(pattern, text); err != nil {
+			t.Fatalf("error can not capture : %s", err.Error())
+		} else {
+			if captures[key] != value {
+				t.Fatalf("%s should be '%s' have '%s'", key, value, captures[key])
+			}
+		}
+	}
+
+	checkNamed := func(key, value, pattern, text string) {
+		g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+		if captures, err := g.Parse(pattern, text); err != nil {
+			t.Fatalf("error can not capture : %s", err.Error())
+		} else {
+			if captures[key] != value {
+				t.Fatalf("%s should be '%s' have '%s'", key, value, captures[key])
+			}
+		}
+
+	}
+
+	check("DAY", "Tue",
+		"%{DAY}",
+		"Tue May 15 11:21:42 [conn1047685] moveChunk deleted: 7157",
+	)
+	checkNamed("jour", "Tue",
+		"%{DAY:jour}",
+		"Tue May 15 11:21:42 [conn1047685] moveChunk deleted: 7157",
+	)
+	check("clientip", "127.0.0.1",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("verb", "GET",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("timestamp", "23/Apr/2014:22:58:32 +0200",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+	check("bytes", "207",
+		"%{COMMONAPACHELOG}",
+		`127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`,
+	)
+
+	//PATH
+	check("WINPATH", `c:\winfows\sdf.txt`, "%{WINPATH}", `s dfqs c:\winfows\sdf.txt`)
+	check("WINPATH", `\\sdf\winfows\sdf.txt`, "%{WINPATH}", `s dfqs \\sdf\winfows\sdf.txt`)
+	check("UNIXPATH", `/usr/lib/`, "%{UNIXPATH}", `s dfqs /usr/lib/ sqfd`)
+	check("UNIXPATH", `/usr/lib`, "%{UNIXPATH}", `s dfqs /usr/lib sqfd`)
+	check("UNIXPATH", `/usr/`, "%{UNIXPATH}", `s dfqs /usr/ sqfd`)
+	check("UNIXPATH", `/usr`, "%{UNIXPATH}", `s dfqs /usr sqfd`)
+	check("UNIXPATH", `/`, "%{UNIXPATH}", `s dfqs / sqfd`)
+
+	//YEAR
+	check("YEAR", `4999`, "%{YEAR}", `s d9fq4999s ../ sdf`)
+	check("YEAR", `79`, "%{YEAR}", `s d79fq4999s ../ sdf`)
+	check("TIMESTAMP_ISO8601", `2013-11-06 04:50:17,1599`, "%{TIMESTAMP_ISO8601}", `s d9fq4999s ../ sdf 2013-11-06 04:50:17,1599sd`)
+
+	//MAC
+	check("MAC", `01:02:03:04:ab:cf`, "%{MAC}", `s d9fq4999s ../ sdf 2013- 01:02:03:04:ab:cf  11-06 04:50:17,1599sd`)
+	check("MAC", `01-02-03-04-ab-cd`, "%{MAC}", `s d9fq4999s ../ sdf 2013- 01-02-03-04-ab-cd  11-06 04:50:17,1599sd`)
+
+	//QUOTEDSTRING
+	check("QUOTEDSTRING", `"lkj"`, "%{QUOTEDSTRING}", `qsdklfjqsd fk"lkj"mkj`)
+	check("QUOTEDSTRING", `'lkj'`, "%{QUOTEDSTRING}", `qsdklfjqsd fk'lkj'mkj`)
+	check("QUOTEDSTRING", `"fk'lkj'm"`, "%{QUOTEDSTRING}", `qsdklfjqsd "fk'lkj'm"kj`)
+	check("QUOTEDSTRING", `'fk"lkj"m'`, "%{QUOTEDSTRING}", `qsdklfjqsd 'fk"lkj"m'kj`)
+
+	//BASE10NUM
+	check("BASE10NUM", `1`, "%{BASE10NUM}", `1`) // this is a nice one
+	check("BASE10NUM", `8080`, "%{BASE10NUM}", `qsfd8080qsfd`)
+
+}
+
+// Should be run with -race
+func TestConcurentParse(t *testing.T) {
+	g, _ := New()
+	g.AddPatternsFromPath("./patterns")
+
+	check := func(key, value, pattern, text string) {
+
+		if captures, err := g.Parse(pattern, text); err != nil {
+			t.Fatalf("error can not capture : %s", err.Error())
+		} else {
+			if captures[key] != value {
+				t.Fatalf("%s should be '%s' have '%s'", key, value, captures[key])
+			}
+		}
+	}
+
+	go check("QUOTEDSTRING", `"lkj"`, "%{QUOTEDSTRING}", `qsdklfjqsd fk"lkj"mkj`)
+	go check("QUOTEDSTRING", `'lkj'`, "%{QUOTEDSTRING}", `qsdklfjqsd fk'lkj'mkj`)
+	go check("QUOTEDSTRING", `'lkj'`, "%{QUOTEDSTRING}", `qsdklfjqsd fk'lkj'mkj`)
+	go check("QUOTEDSTRING", `"fk'lkj'm"`, "%{QUOTEDSTRING}", `qsdklfjqsd "fk'lkj'm"kj`)
+	go check("QUOTEDSTRING", `'fk"lkj"m'`, "%{QUOTEDSTRING}", `qsdklfjqsd 'fk"lkj"m'kj`)
+}
+
+func TestPatterns(t *testing.T) {
+	g, _ := NewWithConfig(&Config{SkipDefaultPatterns: true})
+	if len(g.patterns) != 0 {
+		t.Fatalf("Patterns should return 0, have '%d'", len(g.patterns))
+	}
+	name := "DAY0"
+	pattern := "(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)"
+
+	g.AddPattern(name, pattern)
+	g.AddPattern(name+"1", pattern)
+	if len(g.patterns) != 2 {
+		t.Fatalf("Patterns should return 2, have '%d'", len(g.patterns))
+	}
+}
+
+func TestParseTypedWithDefaultCaptureMode(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	if captures, err := g.ParseTyped("%{IPV4:ip:string} %{NUMBER:status:int} %{NUMBER:duration:float}", `127.0.0.1 200 0.8`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["ip"] != "127.0.0.1" {
+			t.Fatalf("%s should be '%s' have '%s'", "ip", "127.0.0.1", captures["ip"])
+		} else {
+			if captures["status"] != 200 {
+				t.Fatalf("%s should be '%d' have '%d'", "status", 200, captures["status"])
+			} else {
+				if captures["duration"] != 0.8 {
+					t.Fatalf("%s should be '%f' have '%f'", "duration", 0.8, captures["duration"])
+				}
+			}
+		}
+	}
+}
+
+func TestParseTypedWithNoTypeInfo(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	if captures, err := g.ParseTyped("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["timestamp"] != "23/Apr/2014:22:58:32 +0200" {
+			t.Fatalf("%s should be '%s' have '%s'", "timestamp", "23/Apr/2014:22:58:32 +0200", captures["timestamp"])
+		}
+		if captures["TIME"] != nil {
+			t.Fatalf("%s should be nil have '%s'", "TIME", captures["TIME"])
+		}
+	}
+
+	g, _ = New()
+	if captures, err := g.ParseTyped("%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["timestamp"] != "23/Apr/2014:22:58:32 +0200" {
+			t.Fatalf("%s should be '%s' have '%s'", "timestamp", "23/Apr/2014:22:58:32 +0200", captures["timestamp"])
+		}
+		if captures["TIME"] != "22:58:32" {
+			t.Fatalf("%s should be '%s' have '%s'", "TIME", "22:58:32", captures["TIME"])
+		}
+	}
+}
+
+func TestParseTypedWithIntegerTypeCoercion(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	if captures, err := g.ParseTyped("%{WORD:coerced:int}", `5.75`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["coerced"] != 5 {
+			t.Fatalf("%s should be '%s' have '%s'", "coerced", "5", captures["coerced"])
+		}
+	}
+}
+
+func TestParseTypedWithUnknownType(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	if _, err := g.ParseTyped("%{WORD:word:unknown}", `hello`); err == nil {
+		t.Fatalf("parsing an unknown type must result in a conversion error")
+	}
+}
+
+func TestParseTypedErrorCaptureUnknowPattern(t *testing.T) {
+	g, _ := New()
+	pattern := "%{UNKNOWPATTERN}"
+	_, err := g.ParseTyped(pattern, "")
+	if err == nil {
+		t.Fatal("Expected error not set")
+	}
+}
+
+func TestParseTypedWithTypedParents(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	g.AddPattern("TESTCOMMON", `%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes:int}|-)`)
+	if captures, err := g.ParseTyped("%{TESTCOMMON}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["bytes"] != 207 {
+			t.Fatalf("%s should be '%s' have '%s'", "bytes", "207", captures["bytes"])
+		}
+	}
+}
+
+func TestParseTypedWithSemanticHomonyms(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true, SkipDefaultPatterns: true})
+
+	g.AddPattern("BASE10NUM", `([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)`)
+	g.AddPattern("NUMBER", `(?:%{BASE10NUM})`)
+	g.AddPattern("MYNUM", `%{NUMBER:bytes:int}`)
+	g.AddPattern("MYSTR", `%{NUMBER:bytes:string}`)
+
+	if captures, err := g.ParseTyped("%{MYNUM}", `207`); err != nil {
+		t.Fatalf("error can not scapture : %s", err.Error())
+	} else {
+		if captures["bytes"] != 207 {
+			t.Fatalf("%s should be %#v have %#v", "bytes", 207, captures["bytes"])
+		}
+	}
+	if captures, err := g.ParseTyped("%{MYSTR}", `207`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["bytes"] != "207" {
+			t.Fatalf("%s should be %#v have %#v", "bytes", "207", captures["bytes"])
+		}
+	}
+}
+
+var resultNew *Grok
+
+func BenchmarkNew(b *testing.B) {
+	b.ReportAllocs()
+	b.ResetTimer()
+	var g *Grok
+	// run the check function b.N times
+	for n := 0; n < b.N; n++ {
+		g, _ = NewWithConfig(&Config{NamedCapturesOnly: true})
+	}
+	resultNew = g
+}
+
+func BenchmarkCaptures(b *testing.B) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	b.ReportAllocs()
+	b.ResetTimer()
+	// run the check function b.N times
+	for n := 0; n < b.N; n++ {
+		g.Parse(`%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`, `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	}
+}
+
+func BenchmarkCapturesTypedFake(b *testing.B) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	b.ReportAllocs()
+	b.ResetTimer()
+	// run the check function b.N times
+	for n := 0; n < b.N; n++ {
+		g.Parse(`%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`, `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	}
+}
+
+func BenchmarkCapturesTypedReal(b *testing.B) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	b.ReportAllocs()
+	b.ResetTimer()
+	// run the check function b.N times
+	for n := 0; n < b.N; n++ {
+		g.ParseTyped(`%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion:int})?|%{DATA:rawrequest})" %{NUMBER:response:int} (?:%{NUMBER:bytes:int}|-)`, `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+	}
+}
+
+func BenchmarkParallelCaptures(b *testing.B) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	b.RunParallel(func(b *testing.PB) {
+		for b.Next() {
+			g.Parse(`%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`, `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)
+		}
+	})
+}
+
+func TestGrok_AddPatternsFromMap_not_exist(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("AddPatternsFromMap panics: %v", r)
+		}
+	}()
+	g, _ := NewWithConfig(&Config{SkipDefaultPatterns: true})
+	err := g.AddPatternsFromMap(map[string]string{
+		"SOME": "%{NOT_EXIST}",
+	})
+	if err == nil {
+		t.Errorf("AddPatternsFromMap should returns an error")
+	}
+}
+
+func TestGrok_AddPatternsFromMap_simple(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("AddPatternsFromMap panics: %v", r)
+		}
+	}()
+	g, _ := NewWithConfig(&Config{SkipDefaultPatterns: true})
+	err := g.AddPatternsFromMap(map[string]string{
+		"NO3": `\d{3}`,
+	})
+	if err != nil {
+		t.Errorf("AddPatternsFromMap returns an error: %v", err)
+	}
+	mss, err := g.Parse("%{NO3:match}", "333")
+	if err != nil {
+		t.Error("parsing error:", err)
+		t.FailNow()
+	}
+	if mss["match"] != "333" {
+		t.Errorf("bad match: expected 333, got %s", mss["match"])
+	}
+}
+
+func TestGrok_AddPatternsFromMap_complex(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("AddPatternsFromMap panics: %v", r)
+		}
+	}()
+	g, _ := NewWithConfig(&Config{
+		SkipDefaultPatterns: true,
+		NamedCapturesOnly:   true,
+	})
+	err := g.AddPatternsFromMap(map[string]string{
+		"NO3": `\d{3}`,
+		"NO6": "%{NO3}%{NO3}",
+	})
+	if err != nil {
+		t.Errorf("AddPatternsFromMap returns an error: %v", err)
+	}
+	mss, err := g.Parse("%{NO6:number}", "333666")
+	if err != nil {
+		t.Error("parsing error:", err)
+		t.FailNow()
+	}
+	if mss["number"] != "333666" {
+		t.Errorf("bad match: expected 333666, got %s", mss["match"])
+	}
+}
+
+func TestParseStream(t *testing.T) {
+	g, _ := New()
+	pTest := func(m map[string]string) error {
+		ts, ok := m["timestamp"]
+		if !ok {
+			t.Error("timestamp not found")
+		}
+		if len(ts) == 0 {
+			t.Error("empty timestamp")
+		}
+		return nil
+	}
+	const testLog = `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207
+127.0.0.1 - - [23/Apr/2014:22:59:32 +0200] "GET /index.php HTTP/1.1" 404 207
+127.0.0.1 - - [23/Apr/2014:23:00:32 +0200] "GET /index.php HTTP/1.1" 404 207
+`
+
+	r := bufio.NewReader(strings.NewReader(testLog))
+	if err := g.ParseStream(r, "%{COMMONAPACHELOG}", pTest); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestParseStreamError(t *testing.T) {
+	g, _ := New()
+	pTest := func(m map[string]string) error {
+		if _, ok := m["timestamp"]; !ok {
+			return fmt.Errorf("timestamp not found")
+		}
+		return nil
+	}
+	const testLog = `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207
+127.0.0.1 - - [xxxxxxxxxxxxxxxxxxxx +0200] "GET /index.php HTTP/1.1" 404 207
+127.0.0.1 - - [23/Apr/2014:23:00:32 +0200] "GET /index.php HTTP/1.1" 404 207
+`
+
+	r := bufio.NewReader(strings.NewReader(testLog))
+	if err := g.ParseStream(r, "%{COMMONAPACHELOG}", pTest); err == nil {
+		t.Fatal("Error expected")
+	}
+}

vendor/github.com/vjeantet/grok/patterns.go

@@ -0,0 +1,80 @@
+package grok
+
+var patterns = map[string]string{
+	"USERNAME":           `[a-zA-Z0-9._-]+`,
+	"USER":               `%{USERNAME}`,
+	"EMAILLOCALPART":     `[a-zA-Z][a-zA-Z0-9_.+-=:]+`,
+	"EMAILADDRESS":       `%{EMAILLOCALPART}@%{HOSTNAME}`,
+	"HTTPDUSER":          `%{EMAILADDRESS}|%{USER}`,
+	"INT":                `(?:[+-]?(?:[0-9]+))`,
+	"BASE10NUM":          `([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)`,
+	"NUMBER":             `(?:%{BASE10NUM})`,
+	"BASE16NUM":          `(0[xX]?[0-9a-fA-F]+)`,
+	"POSINT":             `\b(?:[1-9][0-9]*)\b`,
+	"NONNEGINT":          `\b(?:[0-9]+)\b`,
+	"WORD":               `\b\w+\b`,
+	"NOTSPACE":           `\S+`,
+	"SPACE":              `\s*`,
+	"DATA":               `.*?`,
+	"GREEDYDATA":         `.*`,
+	"QUOTEDSTRING":       `"([^"\\]*(\\.[^"\\]*)*)"|\'([^\'\\]*(\\.[^\'\\]*)*)\'`,
+	"UUID":               `[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}`,
+	"MAC":                `(?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})`,
+	"CISCOMAC":           `(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})`,
+	"WINDOWSMAC":         `(?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})`,
+	"COMMONMAC":          `(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})`,
+	"IPV6":               `((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?`,
+	"IPV4":               `(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)`,
+	"IP":                 `(?:%{IPV6}|%{IPV4})`,
+	"HOSTNAME":           `\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)`,
+	"HOST":               `%{HOSTNAME}`,
+	"IPORHOST":           `(?:%{IP}|%{HOSTNAME})`,
+	"HOSTPORT":           `%{IPORHOST}:%{POSINT}`,
+	"PATH":               `(?:%{UNIXPATH}|%{WINPATH})`,
+	"UNIXPATH":           `(/[\w_%!$@:.,-]?/?)(\S+)?`,
+	"TTY":                `(?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))`,
+	"WINPATH":            `([A-Za-z]:|\\)(?:\\[^\\?*]*)+`,
+	"URIPROTO":           `[A-Za-z]+(\+[A-Za-z+]+)?`,
+	"URIHOST":            `%{IPORHOST}(?::%{POSINT:port})?`,
+	"URIPATH":            `(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+`,
+	"URIPARAM":           `\?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*`,
+	"URIPATHPARAM":       `%{URIPATH}(?:%{URIPARAM})?`,
+	"URI":                `%{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?`,
+	"MONTH":              `\b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b`,
+	"MONTHNUM":           `(?:0?[1-9]|1[0-2])`,
+	"MONTHNUM2":          `(?:0[1-9]|1[0-2])`,
+	"MONTHDAY":           `(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])`,
+	"DAY":                `(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)`,
+	"YEAR":               `(\d\d){1,2}`,
+	"HOUR":               `(?:2[0123]|[01]?[0-9])`,
+	"MINUTE":             `(?:[0-5][0-9])`,
+	"SECOND":             `(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)`,
+	"TIME":               `([^0-9]?)%{HOUR}:%{MINUTE}(?::%{SECOND})([^0-9]?)`,
+	"DATE_US":            `%{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}`,
+	"DATE_EU":            `%{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}`,
+	"ISO8601_TIMEZONE":   `(?:Z|[+-]%{HOUR}(?::?%{MINUTE}))`,
+	"ISO8601_SECOND":     `(?:%{SECOND}|60)`,
+	"TIMESTAMP_ISO8601":  `%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?`,
+	"DATE":               `%{DATE_US}|%{DATE_EU}`,
+	"DATESTAMP":          `%{DATE}[- ]%{TIME}`,
+	"TZ":                 `(?:[PMCE][SD]T|UTC)`,
+	"DATESTAMP_RFC822":   `%{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}`,
+	"DATESTAMP_RFC2822":  `%{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}`,
+	"DATESTAMP_OTHER":    `%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}`,
+	"DATESTAMP_EVENTLOG": `%{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}`,
+	"HTTPDERROR_DATE":    `%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}`,
+	"SYSLOGTIMESTAMP":    `%{MONTH} +%{MONTHDAY} %{TIME}`,
+	"PROG":               `[\x21-\x5a\x5c\x5e-\x7e]+`,
+	"SYSLOGPROG":         `%{PROG:program}(?:\[%{POSINT:pid}\])?`,
+	"SYSLOGHOST":         `%{IPORHOST}`,
+	"SYSLOGFACILITY":     `<%{NONNEGINT:facility}.%{NONNEGINT:priority}>`,
+	"HTTPDATE":           `%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}`,
+	"QS":                 `%{QUOTEDSTRING}`,
+	"SYSLOGBASE":         `%{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:`,
+	"COMMONAPACHELOG":    `%{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`,
+	"COMBINEDAPACHELOG":  `%{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}`,
+	"HTTPD20_ERRORLOG":   `\[%{HTTPDERROR_DATE:timestamp}\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IPORHOST:clientip}\] ){0,1}%{GREEDYDATA:errormsg}`,
+	"HTTPD24_ERRORLOG":   `\[%{HTTPDERROR_DATE:timestamp}\] \[%{WORD:module}:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}:tid %{NUMBER:tid}\]( \(%{POSINT:proxy_errorcode}\)%{DATA:proxy_errormessage}:)?( \[client %{IPORHOST:client}:%{POSINT:clientport}\])? %{DATA:errorcode}: %{GREEDYDATA:message}`,
+	"HTTPD_ERRORLOG":     `%{HTTPD20_ERRORLOG}|%{HTTPD24_ERRORLOG}`,
+	"LOGLEVEL":           `([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)`,
+}

vendor/github.com/vjeantet/grok/patterns/aws

@@ -0,0 +1,11 @@
+S3_REQUEST_LINE (?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})
+
+S3_ACCESS_LOG %{WORD:owner} %{NOTSPACE:bucket} \[%{HTTPDATE:timestamp}\] %{IP:clientip} %{NOTSPACE:requester} %{NOTSPACE:request_id} %{NOTSPACE:operation} %{NOTSPACE:key} (?:"%{S3_REQUEST_LINE}"|-) (?:%{INT:response:int}|-) (?:-|%{NOTSPACE:error_code}) (?:%{INT:bytes:int}|-) (?:%{INT:object_size:int}|-) (?:%{INT:request_time_ms:int}|-) (?:%{INT:turnaround_time_ms:int}|-) (?:%{QS:referrer}|-) (?:"?%{QS:agent}"?|-) (?:-|%{NOTSPACE:version_id})
+
+ELB_URIPATHPARAM %{URIPATH:path}(?:%{URIPARAM:params})?
+
+ELB_URI %{URIPROTO:proto}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST:urihost})?(?:%{ELB_URIPATHPARAM})?
+
+ELB_REQUEST_LINE (?:%{WORD:verb} %{ELB_URI:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})
+
+ELB_ACCESS_LOG %{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request_processing_time:float} %{NUMBER:backend_processing_time:float} %{NUMBER:response_processing_time:float} %{INT:response:int} %{INT:backend_response:int} %{INT:received_bytes:int} %{INT:bytes:int} "%{ELB_REQUEST_LINE}"

vendor/github.com/vjeantet/grok/patterns/bacula

@@ -0,0 +1,50 @@
+BACULA_TIMESTAMP %{MONTHDAY}-%{MONTH} %{HOUR}:%{MINUTE}
+BACULA_HOST [a-zA-Z0-9-]+
+BACULA_VOLUME %{USER}
+BACULA_DEVICE %{USER}
+BACULA_DEVICEPATH %{UNIXPATH}
+BACULA_CAPACITY %{INT}{1,3}(,%{INT}{3})*
+BACULA_VERSION %{USER}
+BACULA_JOB %{USER}
+
+BACULA_LOG_MAX_CAPACITY User defined maximum volume capacity %{BACULA_CAPACITY} exceeded on device \"%{BACULA_DEVICE:device}\" \(%{BACULA_DEVICEPATH}\)
+BACULA_LOG_END_VOLUME End of medium on Volume \"%{BACULA_VOLUME:volume}\" Bytes=%{BACULA_CAPACITY} Blocks=%{BACULA_CAPACITY} at %{MONTHDAY}-%{MONTH}-%{YEAR} %{HOUR}:%{MINUTE}.
+BACULA_LOG_NEW_VOLUME Created new Volume \"%{BACULA_VOLUME:volume}\" in catalog.
+BACULA_LOG_NEW_LABEL Labeled new Volume \"%{BACULA_VOLUME:volume}\" on device \"%{BACULA_DEVICE:device}\" \(%{BACULA_DEVICEPATH}\).
+BACULA_LOG_WROTE_LABEL Wrote label to prelabeled Volume \"%{BACULA_VOLUME:volume}\" on device \"%{BACULA_DEVICE}\" \(%{BACULA_DEVICEPATH}\)
+BACULA_LOG_NEW_MOUNT New volume \"%{BACULA_VOLUME:volume}\" mounted on device \"%{BACULA_DEVICE:device}\" \(%{BACULA_DEVICEPATH}\) at %{MONTHDAY}-%{MONTH}-%{YEAR} %{HOUR}:%{MINUTE}.
+BACULA_LOG_NOOPEN \s+Cannot open %{DATA}: ERR=%{GREEDYDATA:berror}
+BACULA_LOG_NOOPENDIR \s+Could not open directory %{DATA}: ERR=%{GREEDYDATA:berror}
+BACULA_LOG_NOSTAT \s+Could not stat %{DATA}: ERR=%{GREEDYDATA:berror}
+BACULA_LOG_NOJOBS There are no more Jobs associated with Volume \"%{BACULA_VOLUME:volume}\". Marking it purged.
+BACULA_LOG_ALL_RECORDS_PRUNED All records pruned from Volume \"%{BACULA_VOLUME:volume}\"; marking it \"Purged\"
+BACULA_LOG_BEGIN_PRUNE_JOBS Begin pruning Jobs older than %{INT} month %{INT} days .
+BACULA_LOG_BEGIN_PRUNE_FILES Begin pruning Files.
+BACULA_LOG_PRUNED_JOBS Pruned %{INT} Jobs* for client %{BACULA_HOST:client} from catalog.
+BACULA_LOG_PRUNED_FILES Pruned Files from %{INT} Jobs* for client %{BACULA_HOST:client} from catalog.
+BACULA_LOG_ENDPRUNE End auto prune.
+BACULA_LOG_STARTJOB Start Backup JobId %{INT}, Job=%{BACULA_JOB:job}
+BACULA_LOG_STARTRESTORE Start Restore Job %{BACULA_JOB:job}
+BACULA_LOG_USEDEVICE Using Device \"%{BACULA_DEVICE:device}\"
+BACULA_LOG_DIFF_FS \s+%{UNIXPATH} is a different filesystem. Will not descend from %{UNIXPATH} into it.
+BACULA_LOG_JOBEND Job write elapsed time = %{DATA:elapsed}, Transfer rate = %{NUMBER} (K|M|G)? Bytes/second
+BACULA_LOG_NOPRUNE_JOBS No Jobs found to prune.
+BACULA_LOG_NOPRUNE_FILES No Files found to prune.
+BACULA_LOG_VOLUME_PREVWRITTEN Volume \"%{BACULA_VOLUME:volume}\" previously written, moving to end of data.
+BACULA_LOG_READYAPPEND Ready to append to end of Volume \"%{BACULA_VOLUME:volume}\" size=%{INT}
+BACULA_LOG_CANCELLING Cancelling duplicate JobId=%{INT}.
+BACULA_LOG_MARKCANCEL JobId %{INT}, Job %{BACULA_JOB:job} marked to be canceled.
+BACULA_LOG_CLIENT_RBJ shell command: run ClientRunBeforeJob \"%{GREEDYDATA:runjob}\"
+BACULA_LOG_VSS (Generate )?VSS (Writer)?
+BACULA_LOG_MAXSTART Fatal error: Job canceled because max start delay time exceeded.
+BACULA_LOG_DUPLICATE Fatal error: JobId %{INT:duplicate} already running. Duplicate job not allowed.
+BACULA_LOG_NOJOBSTAT Fatal error: No Job status returned from FD.
+BACULA_LOG_FATAL_CONN Fatal error: bsock.c:133 Unable to connect to (Client: %{BACULA_HOST:client}|Storage daemon) on %{HOSTNAME}:%{POSINT}. ERR=(?<berror>%{GREEDYDATA})
+BACULA_LOG_NO_CONNECT Warning: bsock.c:127 Could not connect to (Client: %{BACULA_HOST:client}|Storage daemon) on %{HOSTNAME}:%{POSINT}. ERR=(?<berror>%{GREEDYDATA})
+BACULA_LOG_NO_AUTH Fatal error: Unable to authenticate with File daemon at %{HOSTNAME}. Possible causes:
+BACULA_LOG_NOSUIT No prior or suitable Full backup found in catalog. Doing FULL backup.
+BACULA_LOG_NOPRIOR No prior Full backup Job record found.
+
+BACULA_LOG_JOB (Error: )?Bacula %{BACULA_HOST} %{BACULA_VERSION} \(%{BACULA_VERSION}\):
+
+BACULA_LOGLINE %{BACULA_TIMESTAMP:bts} %{BACULA_HOST:hostname} JobId %{INT:jobid}: (%{BACULA_LOG_MAX_CAPACITY}|%{BACULA_LOG_END_VOLUME}|%{BACULA_LOG_NEW_VOLUME}|%{BACULA_LOG_NEW_LABEL}|%{BACULA_LOG_WROTE_LABEL}|%{BACULA_LOG_NEW_MOUNT}|%{BACULA_LOG_NOOPEN}|%{BACULA_LOG_NOOPENDIR}|%{BACULA_LOG_NOSTAT}|%{BACULA_LOG_NOJOBS}|%{BACULA_LOG_ALL_RECORDS_PRUNED}|%{BACULA_LOG_BEGIN_PRUNE_JOBS}|%{BACULA_LOG_BEGIN_PRUNE_FILES}|%{BACULA_LOG_PRUNED_JOBS}|%{BACULA_LOG_PRUNED_FILES}|%{BACULA_LOG_ENDPRUNE}|%{BACULA_LOG_STARTJOB}|%{BACULA_LOG_STARTRESTORE}|%{BACULA_LOG_USEDEVICE}|%{BACULA_LOG_DIFF_FS}|%{BACULA_LOG_JOBEND}|%{BACULA_LOG_NOPRUNE_JOBS}|%{BACULA_LOG_NOPRUNE_FILES}|%{BACULA_LOG_VOLUME_PREVWRITTEN}|%{BACULA_LOG_READYAPPEND}|%{BACULA_LOG_CANCELLING}|%{BACULA_LOG_MARKCANCEL}|%{BACULA_LOG_CLIENT_RBJ}|%{BACULA_LOG_VSS}|%{BACULA_LOG_MAXSTART}|%{BACULA_LOG_DUPLICATE}|%{BACULA_LOG_NOJOBSTAT}|%{BACULA_LOG_FATAL_CONN}|%{BACULA_LOG_NO_CONNECT}|%{BACULA_LOG_NO_AUTH}|%{BACULA_LOG_NOSUIT}|%{BACULA_LOG_JOB}|%{BACULA_LOG_NOPRIOR})

vendor/github.com/vjeantet/grok/patterns/bro

@@ -0,0 +1,13 @@
+# https://www.bro.org/sphinx/script-reference/log-files.html
+
+# http.log
+BRO_HTTP %{NUMBER:ts}\t%{NOTSPACE:uid}\t%{IP:orig_h}\t%{INT:orig_p}\t%{IP:resp_h}\t%{INT:resp_p}\t%{INT:trans_depth}\t%{GREEDYDATA:method}\t%{GREEDYDATA:domain}\t%{GREEDYDATA:uri}\t%{GREEDYDATA:referrer}\t%{GREEDYDATA:user_agent}\t%{NUMBER:request_body_len}\t%{NUMBER:response_body_len}\t%{GREEDYDATA:status_code}\t%{GREEDYDATA:status_msg}\t%{GREEDYDATA:info_code}\t%{GREEDYDATA:info_msg}\t%{GREEDYDATA:filename}\t%{GREEDYDATA:bro_tags}\t%{GREEDYDATA:username}\t%{GREEDYDATA:password}\t%{GREEDYDATA:proxied}\t%{GREEDYDATA:orig_fuids}\t%{GREEDYDATA:orig_mime_types}\t%{GREEDYDATA:resp_fuids}\t%{GREEDYDATA:resp_mime_types}
+
+# dns.log
+BRO_DNS %{NUMBER:ts}\t%{NOTSPACE:uid}\t%{IP:orig_h}\t%{INT:orig_p}\t%{IP:resp_h}\t%{INT:resp_p}\t%{WORD:proto}\t%{INT:trans_id}\t%{GREEDYDATA:query}\t%{GREEDYDATA:qclass}\t%{GREEDYDATA:qclass_name}\t%{GREEDYDATA:qtype}\t%{GREEDYDATA:qtype_name}\t%{GREEDYDATA:rcode}\t%{GREEDYDATA:rcode_name}\t%{GREEDYDATA:AA}\t%{GREEDYDATA:TC}\t%{GREEDYDATA:RD}\t%{GREEDYDATA:RA}\t%{GREEDYDATA:Z}\t%{GREEDYDATA:answers}\t%{GREEDYDATA:TTLs}\t%{GREEDYDATA:rejected}
+
+# conn.log
+BRO_CONN %{NUMBER:ts}\t%{NOTSPACE:uid}\t%{IP:orig_h}\t%{INT:orig_p}\t%{IP:resp_h}\t%{INT:resp_p}\t%{WORD:proto}\t%{GREEDYDATA:service}\t%{NUMBER:duration}\t%{NUMBER:orig_bytes}\t%{NUMBER:resp_bytes}\t%{GREEDYDATA:conn_state}\t%{GREEDYDATA:local_orig}\t%{GREEDYDATA:missed_bytes}\t%{GREEDYDATA:history}\t%{GREEDYDATA:orig_pkts}\t%{GREEDYDATA:orig_ip_bytes}\t%{GREEDYDATA:resp_pkts}\t%{GREEDYDATA:resp_ip_bytes}\t%{GREEDYDATA:tunnel_parents}
+
+# files.log
+BRO_FILES %{NUMBER:ts}\t%{NOTSPACE:fuid}\t%{IP:tx_hosts}\t%{IP:rx_hosts}\t%{NOTSPACE:conn_uids}\t%{GREEDYDATA:source}\t%{GREEDYDATA:depth}\t%{GREEDYDATA:analyzers}\t%{GREEDYDATA:mime_type}\t%{GREEDYDATA:filename}\t%{GREEDYDATA:duration}\t%{GREEDYDATA:local_orig}\t%{GREEDYDATA:is_orig}\t%{GREEDYDATA:seen_bytes}\t%{GREEDYDATA:total_bytes}\t%{GREEDYDATA:missing_bytes}\t%{GREEDYDATA:overflow_bytes}\t%{GREEDYDATA:timedout}\t%{GREEDYDATA:parent_fuid}\t%{GREEDYDATA:md5}\t%{GREEDYDATA:sha1}\t%{GREEDYDATA:sha256}\t%{GREEDYDATA:extracted}

vendor/github.com/vjeantet/grok/patterns/exim

@@ -0,0 +1,13 @@
+EXIM_MSGID [0-9A-Za-z]{6}-[0-9A-Za-z]{6}-[0-9A-Za-z]{2}
+EXIM_FLAGS (<=|[-=>*]>|[*]{2}|==)
+EXIM_DATE %{YEAR:exim_year}-%{MONTHNUM:exim_month}-%{MONTHDAY:exim_day} %{TIME:exim_time}
+EXIM_PID \[%{POSINT}\]
+EXIM_QT ((\d+y)?(\d+w)?(\d+d)?(\d+h)?(\d+m)?(\d+s)?)
+EXIM_EXCLUDE_TERMS (Message is frozen|(Start|End) queue run| Warning: | retry time not reached | no (IP address|host name) found for (IP address|host) | unexpected disconnection while reading SMTP command | no immediate delivery: |another process is handling this message)
+EXIM_REMOTE_HOST (H=(%{NOTSPACE:remote_hostname} )?(\(%{NOTSPACE:remote_heloname}\) )?\[%{IP:remote_host}\])
+EXIM_INTERFACE (I=\[%{IP:exim_interface}\](:%{NUMBER:exim_interface_port}))
+EXIM_PROTOCOL (P=%{NOTSPACE:protocol})
+EXIM_MSG_SIZE (S=%{NUMBER:exim_msg_size})
+EXIM_HEADER_ID (id=%{NOTSPACE:exim_header_id})
+EXIM_SUBJECT (T=%{QS:exim_subject})
+

vendor/github.com/vjeantet/grok/patterns/firewalls

@@ -0,0 +1,86 @@
+# NetScreen firewall logs
+NETSCREENSESSIONLOG %{SYSLOGTIMESTAMP:date} %{IPORHOST:device} %{IPORHOST}: NetScreen device_id=%{WORD:device_id}%{DATA}: start_time=%{QUOTEDSTRING:start_time} duration=%{INT:duration} policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:proto} src zone=%{WORD:src_zone} dst zone=%{WORD:dst_zone} action=%{WORD:action} sent=%{INT:sent} rcvd=%{INT:rcvd} src=%{IPORHOST:src_ip} dst=%{IPORHOST:dst_ip} src_port=%{INT:src_port} dst_port=%{INT:dst_port} src-xlated ip=%{IPORHOST:src_xlated_ip} port=%{INT:src_xlated_port} dst-xlated ip=%{IPORHOST:dst_xlated_ip} port=%{INT:dst_xlated_port} session_id=%{INT:session_id} reason=%{GREEDYDATA:reason}
+
+#== Cisco ASA ==
+CISCO_TAGGED_SYSLOG ^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}:
+CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}
+CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9_]+)
+# Common Particles
+CISCO_ACTION Built|Teardown|Deny|Denied|denied|requested|permitted|denied by ACL|discarded|est-allowed|Dropping|created|deleted
+CISCO_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s*)*
+CISCO_DIRECTION Inbound|inbound|Outbound|outbound
+CISCO_INTERVAL first hit|%{INT}-second interval
+CISCO_XLATE_TYPE static|dynamic
+# ASA-1-104001
+CISCOFW104001 \((?:Primary|Secondary)\) Switching to ACTIVE - %{GREEDYDATA:switch_reason}
+# ASA-1-104002
+CISCOFW104002 \((?:Primary|Secondary)\) Switching to STANDBY - %{GREEDYDATA:switch_reason}
+# ASA-1-104003
+CISCOFW104003 \((?:Primary|Secondary)\) Switching to FAILED\.
+# ASA-1-104004
+CISCOFW104004 \((?:Primary|Secondary)\) Switching to OK\.
+# ASA-1-105003
+CISCOFW105003 \((?:Primary|Secondary)\) Monitoring on [Ii]nterface %{GREEDYDATA:interface_name} waiting
+# ASA-1-105004
+CISCOFW105004 \((?:Primary|Secondary)\) Monitoring on [Ii]nterface %{GREEDYDATA:interface_name} normal
+# ASA-1-105005
+CISCOFW105005 \((?:Primary|Secondary)\) Lost Failover communications with mate on [Ii]nterface %{GREEDYDATA:interface_name}
+# ASA-1-105008
+CISCOFW105008 \((?:Primary|Secondary)\) Testing [Ii]nterface %{GREEDYDATA:interface_name}
+# ASA-1-105009
+CISCOFW105009 \((?:Primary|Secondary)\) Testing on [Ii]nterface %{GREEDYDATA:interface_name} (?:Passed|Failed)
+# ASA-2-106001
+CISCOFW106001 %{CISCO_DIRECTION:direction} %{WORD:protocol} connection %{CISCO_ACTION:action} from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} flags %{GREEDYDATA:tcp_flags} on interface %{GREEDYDATA:interface}
+# ASA-2-106006, ASA-2-106007, ASA-2-106010
+CISCOFW106006_106007_106010 %{CISCO_ACTION:action} %{CISCO_DIRECTION:direction} %{WORD:protocol} (?:from|src) %{IP:src_ip}/%{INT:src_port}(\(%{DATA:src_fwuser}\))? (?:to|dst) %{IP:dst_ip}/%{INT:dst_port}(\(%{DATA:dst_fwuser}\))? (?:on interface %{DATA:interface}|due to %{CISCO_REASON:reason})
+# ASA-3-106014
+CISCOFW106014 %{CISCO_ACTION:action} %{CISCO_DIRECTION:direction} %{WORD:protocol} src %{DATA:src_interface}:%{IP:src_ip}(\(%{DATA:src_fwuser}\))? dst %{DATA:dst_interface}:%{IP:dst_ip}(\(%{DATA:dst_fwuser}\))? \(type %{INT:icmp_type}, code %{INT:icmp_code}\)
+# ASA-6-106015
+CISCOFW106015 %{CISCO_ACTION:action} %{WORD:protocol} \(%{DATA:policy_id}\) from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} flags %{DATA:tcp_flags}  on interface %{GREEDYDATA:interface}
+# ASA-1-106021
+CISCOFW106021 %{CISCO_ACTION:action} %{WORD:protocol} reverse path check from %{IP:src_ip} to %{IP:dst_ip} on interface %{GREEDYDATA:interface}
+# ASA-4-106023
+CISCOFW106023 %{CISCO_ACTION:action}( protocol)? %{WORD:protocol} src %{DATA:src_interface}:%{DATA:src_ip}(/%{INT:src_port})?(\(%{DATA:src_fwuser}\))? dst %{DATA:dst_interface}:%{DATA:dst_ip}(/%{INT:dst_port})?(\(%{DATA:dst_fwuser}\))?( \(type %{INT:icmp_type}, code %{INT:icmp_code}\))? by access-group "?%{DATA:policy_id}"? \[%{DATA:hashcode1}, %{DATA:hashcode2}\]
+# ASA-4-106100, ASA-4-106102, ASA-4-106103
+CISCOFW106100_2_3 access-list %{NOTSPACE:policy_id} %{CISCO_ACTION:action} %{WORD:protocol} for user '%{DATA:src_fwuser}' %{DATA:src_interface}/%{IP:src_ip}\(%{INT:src_port}\) -> %{DATA:dst_interface}/%{IP:dst_ip}\(%{INT:dst_port}\) hit-cnt %{INT:hit_count} %{CISCO_INTERVAL:interval} \[%{DATA:hashcode1}, %{DATA:hashcode2}\]
+# ASA-5-106100
+CISCOFW106100 access-list %{NOTSPACE:policy_id} %{CISCO_ACTION:action} %{WORD:protocol} %{DATA:src_interface}/%{IP:src_ip}\(%{INT:src_port}\)(\(%{DATA:src_fwuser}\))? -> %{DATA:dst_interface}/%{IP:dst_ip}\(%{INT:dst_port}\)(\(%{DATA:src_fwuser}\))? hit-cnt %{INT:hit_count} %{CISCO_INTERVAL:interval} \[%{DATA:hashcode1}, %{DATA:hashcode2}\]
+# ASA-6-110002
+CISCOFW110002 %{CISCO_REASON:reason} for %{WORD:protocol} from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port}
+# ASA-6-302010
+CISCOFW302010 %{INT:connection_count} in use, %{INT:connection_count_max} most used
+# ASA-6-302013, ASA-6-302014, ASA-6-302015, ASA-6-302016
+CISCOFW302013_302014_302015_302016 %{CISCO_ACTION:action}(?: %{CISCO_DIRECTION:direction})? %{WORD:protocol} connection %{INT:connection_id} for %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port}( \(%{IP:src_mapped_ip}/%{INT:src_mapped_port}\))?(\(%{DATA:src_fwuser}\))? to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}( \(%{IP:dst_mapped_ip}/%{INT:dst_mapped_port}\))?(\(%{DATA:dst_fwuser}\))?( duration %{TIME:duration} bytes %{INT:bytes})?(?: %{CISCO_REASON:reason})?( \(%{DATA:user}\))?
+# ASA-6-302020, ASA-6-302021
+CISCOFW302020_302021 %{CISCO_ACTION:action}(?: %{CISCO_DIRECTION:direction})? %{WORD:protocol} connection for faddr %{IP:dst_ip}/%{INT:icmp_seq_num}(?:\(%{DATA:fwuser}\))? gaddr %{IP:src_xlated_ip}/%{INT:icmp_code_xlated} laddr %{IP:src_ip}/%{INT:icmp_code}( \(%{DATA:user}\))?
+# ASA-6-305011
+CISCOFW305011 %{CISCO_ACTION:action} %{CISCO_XLATE_TYPE:xlate_type} %{WORD:protocol} translation from %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port})?(\(%{DATA:src_fwuser}\))? to %{DATA:src_xlated_interface}:%{IP:src_xlated_ip}/%{DATA:src_xlated_port}
+# ASA-3-313001, ASA-3-313004, ASA-3-313008
+CISCOFW313001_313004_313008 %{CISCO_ACTION:action} %{WORD:protocol} type=%{INT:icmp_type}, code=%{INT:icmp_code} from %{IP:src_ip} on interface %{DATA:interface}( to %{IP:dst_ip})?
+# ASA-4-313005
+CISCOFW313005 %{CISCO_REASON:reason} for %{WORD:protocol} error message: %{WORD:err_protocol} src %{DATA:err_src_interface}:%{IP:err_src_ip}(\(%{DATA:err_src_fwuser}\))? dst %{DATA:err_dst_interface}:%{IP:err_dst_ip}(\(%{DATA:err_dst_fwuser}\))? \(type %{INT:err_icmp_type}, code %{INT:err_icmp_code}\) on %{DATA:interface} interface\.  Original IP payload: %{WORD:protocol} src %{IP:orig_src_ip}/%{INT:orig_src_port}(\(%{DATA:orig_src_fwuser}\))? dst %{IP:orig_dst_ip}/%{INT:orig_dst_port}(\(%{DATA:orig_dst_fwuser}\))?
+# ASA-5-321001
+CISCOFW321001 Resource '%{WORD:resource_name}' limit of %{POSINT:resource_limit} reached for system
+# ASA-4-402117
+CISCOFW402117 %{WORD:protocol}: Received a non-IPSec packet \(protocol= %{WORD:orig_protocol}\) from %{IP:src_ip} to %{IP:dst_ip}
+# ASA-4-402119
+CISCOFW402119 %{WORD:protocol}: Received an %{WORD:orig_protocol} packet \(SPI= %{DATA:spi}, sequence number= %{DATA:seq_num}\) from %{IP:src_ip} \(user= %{DATA:user}\) to %{IP:dst_ip} that failed anti-replay checking
+# ASA-4-419001
+CISCOFW419001 %{CISCO_ACTION:action} %{WORD:protocol} packet from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}, reason: %{GREEDYDATA:reason}
+# ASA-4-419002
+CISCOFW419002 %{CISCO_REASON:reason} from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port} with different initial sequence number
+# ASA-4-500004
+CISCOFW500004 %{CISCO_REASON:reason} for protocol=%{WORD:protocol}, from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port}
+# ASA-6-602303, ASA-6-602304
+CISCOFW602303_602304 %{WORD:protocol}: An %{CISCO_DIRECTION:direction} %{GREEDYDATA:tunnel_type} SA \(SPI= %{DATA:spi}\) between %{IP:src_ip} and %{IP:dst_ip} \(user= %{DATA:user}\) has been %{CISCO_ACTION:action}
+# ASA-7-710001, ASA-7-710002, ASA-7-710003, ASA-7-710005, ASA-7-710006
+CISCOFW710001_710002_710003_710005_710006 %{WORD:protocol} (?:request|access) %{CISCO_ACTION:action} from %{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}
+# ASA-6-713172
+CISCOFW713172 Group = %{GREEDYDATA:group}, IP = %{IP:src_ip}, Automatic NAT Detection Status:\s+Remote end\s*%{DATA:is_remote_natted}\s*behind a NAT device\s+This\s+end\s*%{DATA:is_local_natted}\s*behind a NAT device
+# ASA-4-733100
+CISCOFW733100 \[\s*%{DATA:drop_type}\s*\] drop %{DATA:drop_rate_id} exceeded. Current burst rate is %{INT:drop_rate_current_burst} per second, max configured rate is %{INT:drop_rate_max_burst}; Current average rate is %{INT:drop_rate_current_avg} per second, max configured rate is %{INT:drop_rate_max_avg}; Cumulative total count is %{INT:drop_total_count}
+#== End Cisco ASA ==
+
+# Shorewall firewall logs
+SHOREWALL (%{SYSLOGTIMESTAMP:timestamp}) (%{WORD:nf_host}) kernel:.*Shorewall:(%{WORD:nf_action1})?:(%{WORD:nf_action2})?.*IN=(%{USERNAME:nf_in_interface})?.*(OUT= *MAC=(%{COMMONMAC:nf_dst_mac}):(%{COMMONMAC:nf_src_mac})?|OUT=%{USERNAME:nf_out_interface}).*SRC=(%{IPV4:nf_src_ip}).*DST=(%{IPV4:nf_dst_ip}).*LEN=(%{WORD:nf_len}).?*TOS=(%{WORD:nf_tos}).?*PREC=(%{WORD:nf_prec}).?*TTL=(%{INT:nf_ttl}).?*ID=(%{INT:nf_id}).?*PROTO=(%{WORD:nf_protocol}).?*SPT=(%{INT:nf_src_port}?.*DPT=%{INT:nf_dst_port}?.*)
+#== End Shorewall

vendor/github.com/vjeantet/grok/patterns/grok-patterns

@@ -0,0 +1,99 @@
+USERNAME [a-zA-Z0-9._-]+
+USER %{USERNAME}
+INT (?:[+-]?(?:[0-9]+))
+BASE10NUM ([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)
+NUMBER (?:%{BASE10NUM})
+BASE16NUM (0[xX]?[0-9a-fA-F]+)
+#BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b
+
+POSINT \b(?:[1-9][0-9]*)\b
+NONNEGINT \b(?:[0-9]+)\b
+WORD \b\w+\b
+NOTSPACE \S+
+SPACE \s*
+DATA .*?
+GREEDYDATA .*
+QUOTEDSTRING "([^"\\]*(\\.[^"\\]*)*)"|\'([^\'\\]*(\\.[^\'\\]*)*)\'
+UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}
+
+# Networking
+MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})
+CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})
+WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})
+COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
+IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?
+IPV4 (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
+IP (?:%{IPV6}|%{IPV4})
+HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
+HOST %{HOSTNAME}
+IPORHOST (?:%{HOSTNAME}|%{IP})
+HOSTPORT %{IPORHOST}:%{POSINT}
+
+# paths
+PATH (?:%{UNIXPATH}|%{WINPATH})
+#UNIXPATH (?>/(?>[\w_%!$@:.,-]+|\\.)*)+
+UNIXPATH (/[\w_%!$@:.,-]?/?)(\S+)?
+TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))
+#WINPATH (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+
+WINPATH ([A-Za-z]:|\\)(?:\\[^\\?*]*)+
+
+URIPROTO [A-Za-z]+(\+[A-Za-z+]+)?
+URIHOST %{IPORHOST}(?::%{POSINT:port})?
+# uripath comes loosely from RFC1738, but mostly from what Firefox
+# doesn't turn into %XX
+URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+
+#URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)?
+URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]*
+URIPATHPARAM %{URIPATH}(?:%{URIPARAM})?
+URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?
+
+# Months: January, Feb, 3, 03, 12, December
+MONTH \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b
+MONTHNUM (?:0?[1-9]|1[0-2])
+MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])
+
+# Days: Monday, Tue, Thu, etc...
+DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)
+
+# Years?
+#YEAR (?>\d\d){1,2}
+#c
+YEAR (\d\d){1,2}
+
+HOUR (?:2[0123]|[01]?[0-9])
+MINUTE (?:[0-5][0-9])
+# '60' is a leap second in most time standards and thus is valid.
+SECOND (?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?)
+#TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
+#c
+TIME ([^0-9]?)%{HOUR}:%{MINUTE}(?::%{SECOND})([^0-9]?)
+# datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it)
+DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}
+DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}
+ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE}))
+ISO8601_SECOND (?:%{SECOND}|60)
+TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
+DATE %{DATE_US}|%{DATE_EU}
+DATESTAMP %{DATE}[- ]%{TIME}
+TZ (?:[PMCE][SD]T|UTC|GMT)
+DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
+DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}
+
+# Syslog Dates: Month Day HH:MM:SS
+SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}
+PROG (?:[\w._/%-]+)
+SYSLOGPROG %{PROG:program}(?:\[%{POSINT:pid}\])?
+SYSLOGHOST %{IPORHOST}
+SYSLOGFACILITY <%{NONNEGINT:facility}.%{NONNEGINT:priority}>
+HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}
+
+# Shortcuts
+QS %{QUOTEDSTRING}
+
+# Log formats
+SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:
+COMMONAPACHELOG %{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)
+COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}
+
+# Log Levels
+LOGLEVEL ([A-a]lert|ALERT|[T|t]race|TRACE|[D|d]ebug|DEBUG|[N|n]otice|NOTICE|[I|i]nfo|INFO|[W|w]arn?(?:ing)?|WARN?(?:ING)?|[E|e]rr?(?:or)?|ERR?(?:OR)?|[C|c]rit?(?:ical)?|CRIT?(?:ICAL)?|[F|f]atal|FATAL|[S|s]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)

vendor/github.com/vjeantet/grok/patterns/haproxy

@@ -0,0 +1,39 @@
+## These patterns were tested w/ haproxy-1.4.15
+
+## Documentation of the haproxy log formats can be found at the following links:
+## http://code.google.com/p/haproxy-docs/wiki/HTTPLogFormat
+## http://code.google.com/p/haproxy-docs/wiki/TCPLogFormat
+
+HAPROXYTIME (?!<[0-9])%{HOUR:haproxy_hour}:%{MINUTE:haproxy_minute}(?::%{SECOND:haproxy_second})(?![0-9])
+HAPROXYDATE %{MONTHDAY:haproxy_monthday}/%{MONTH:haproxy_month}/%{YEAR:haproxy_year}:%{HAPROXYTIME:haproxy_time}.%{INT:haproxy_milliseconds}
+
+# Override these default patterns to parse out what is captured in your haproxy.cfg
+HAPROXYCAPTUREDREQUESTHEADERS %{DATA:captured_request_headers}
+HAPROXYCAPTUREDRESPONSEHEADERS %{DATA:captured_response_headers}
+
+# Example:
+#  These haproxy config lines will add data to the logs that are captured
+#  by the patterns below. Place them in your custom patterns directory to
+#  override the defaults.
+#
+#  capture request header Host len 40
+#  capture request header X-Forwarded-For len 50
+#  capture request header Accept-Language len 50
+#  capture request header Referer len 200
+#  capture request header User-Agent len 200
+#
+#  capture response header Content-Type len 30
+#  capture response header Content-Encoding len 10
+#  capture response header Cache-Control len 200
+#  capture response header Last-Modified len 200
+#
+# HAPROXYCAPTUREDREQUESTHEADERS %{DATA:request_header_host}\|%{DATA:request_header_x_forwarded_for}\|%{DATA:request_header_accept_language}\|%{DATA:request_header_referer}\|%{DATA:request_header_user_agent}
+# HAPROXYCAPTUREDRESPONSEHEADERS %{DATA:response_header_content_type}\|%{DATA:response_header_content_encoding}\|%{DATA:response_header_cache_control}\|%{DATA:response_header_last_modified}
+
+# parse a haproxy 'httplog' line
+HAPROXYHTTPBASE %{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:time_request}/%{INT:time_queue}/%{INT:time_backend_connect}/%{INT:time_backend_response}/%{NOTSPACE:time_duration} %{INT:http_status_code} %{NOTSPACE:bytes_read} %{DATA:captured_request_cookie} %{DATA:captured_response_cookie} %{NOTSPACE:termination_state} %{INT:actconn}/%{INT:feconn}/%{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv_queue}/%{INT:backend_queue} (\{%{HAPROXYCAPTUREDREQUESTHEADERS}\})?( )?(\{%{HAPROXYCAPTUREDRESPONSEHEADERS}\})?( )?"(<BADREQ>|(%{WORD:http_verb} (%{URIPROTO:http_proto}://)?(?:%{USER:http_user}(?::[^@]*)?@)?(?:%{URIHOST:http_host})?(?:%{URIPATHPARAM:http_request})?( HTTP/%{NUMBER:http_version})?))?"
+
+HAPROXYHTTP (?:%{SYSLOGTIMESTAMP:syslog_timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) %{IPORHOST:syslog_server} %{SYSLOGPROG}: %{HAPROXYHTTPBASE}
+
+# parse a haproxy 'tcplog' line
+HAPROXYTCP (?:%{SYSLOGTIMESTAMP:syslog_timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) %{IPORHOST:syslog_server} %{SYSLOGPROG}: %{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:time_queue}/%{INT:time_backend_connect}/%{NOTSPACE:time_duration} %{NOTSPACE:bytes_read} %{NOTSPACE:termination_state} %{INT:actconn}/%{INT:feconn}/%{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv_queue}/%{INT:backend_queue}

vendor/github.com/vjeantet/grok/patterns/java

@@ -0,0 +1,20 @@
+JAVACLASS (?:[a-zA-Z$_][a-zA-Z$_0-9]*\.)*[a-zA-Z$_][a-zA-Z$_0-9]*
+#Space is an allowed character to match special cases like 'Native Method' or 'Unknown Source'
+JAVAFILE (?:[A-Za-z0-9_. -]+)
+#Allow special <init> method
+JAVAMETHOD (?:(<init>)|[a-zA-Z$_][a-zA-Z$_0-9]*)
+#Line number is optional in special cases 'Native method' or 'Unknown source'
+JAVASTACKTRACEPART %{SPACE}at %{JAVACLASS:class}\.%{JAVAMETHOD:method}\(%{JAVAFILE:file}(?::%{NUMBER:line})?\)
+# Java Logs
+JAVATHREAD (?:[A-Z]{2}-Processor[\d]+)
+JAVACLASS (?:[a-zA-Z0-9-]+\.)+[A-Za-z0-9$]+
+JAVAFILE (?:[A-Za-z0-9_.-]+)
+JAVASTACKTRACEPART at %{JAVACLASS:class}\.%{WORD:method}\(%{JAVAFILE:file}:%{NUMBER:line}\)
+JAVALOGMESSAGE (.*)
+# MMM dd, yyyy HH:mm:ss eg: Jan 9, 2014 7:13:13 AM
+CATALINA_DATESTAMP %{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM)
+# yyyy-MM-dd HH:mm:ss,SSS ZZZ eg: 2014-01-09 17:32:25,527 -0800
+TOMCAT_DATESTAMP 20%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{ISO8601_TIMEZONE}
+CATALINALOG %{CATALINA_DATESTAMP:timestamp} %{JAVACLASS:class} %{JAVALOGMESSAGE:logmessage}
+# 2014-01-09 20:03:28,269 -0800 | ERROR | com.example.service.ExampleService - something compeletely unexpected happened...
+TOMCATLOG %{TOMCAT_DATESTAMP:timestamp} \| %{LOGLEVEL:level} \| %{JAVACLASS:class} - %{JAVALOGMESSAGE:logmessage}

vendor/github.com/vjeantet/grok/patterns/junos

@@ -0,0 +1,9 @@
+# JUNOS 11.4 RT_FLOW patterns
+RT_FLOW_EVENT (RT_FLOW_SESSION_CREATE|RT_FLOW_SESSION_CLOSE|RT_FLOW_SESSION_DENY)
+
+RT_FLOW1 %{RT_FLOW_EVENT:event}: %{GREEDYDATA:close-reason}: %{IP:src-ip}/%{INT:src-port}->%{IP:dst-ip}/%{INT:dst-port} %{DATA:service} %{IP:nat-src-ip}/%{INT:nat-src-port}->%{IP:nat-dst-ip}/%{INT:nat-dst-port} %{DATA:src-nat-rule-name} %{DATA:dst-nat-rule-name} %{INT:protocol-id} %{DATA:policy-name} %{DATA:from-zone} %{DATA:to-zone} %{INT:session-id} \d+\(%{DATA:sent}\) \d+\(%{DATA:received}\) %{INT:elapsed-time} .*
+
+RT_FLOW2 %{RT_FLOW_EVENT:event}: session created %{IP:src-ip}/%{INT:src-port}->%{IP:dst-ip}/%{INT:dst-port} %{DATA:service} %{IP:nat-src-ip}/%{INT:nat-src-port}->%{IP:nat-dst-ip}/%{INT:nat-dst-port} %{DATA:src-nat-rule-name} %{DATA:dst-nat-rule-name} %{INT:protocol-id} %{DATA:policy-name} %{DATA:from-zone} %{DATA:to-zone} %{INT:session-id} .*
+
+RT_FLOW3 %{RT_FLOW_EVENT:event}: session denied %{IP:src-ip}/%{INT:src-port}->%{IP:dst-ip}/%{INT:dst-port} %{DATA:service} %{INT:protocol-id}\(\d\) %{DATA:policy-name} %{DATA:from-zone} %{DATA:to-zone} .*
+

vendor/github.com/vjeantet/grok/patterns/linux-syslog

@@ -0,0 +1,16 @@
+SYSLOG5424PRINTASCII [!-~]+
+
+SYSLOGBASE2 (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource}+(?: %{SYSLOGPROG}:|)
+SYSLOGPAMSESSION %{SYSLOGBASE} (?=%{GREEDYDATA:message})%{WORD:pam_module}\(%{DATA:pam_caller}\): session %{WORD:pam_session_state} for user %{USERNAME:username}(?: by %{GREEDYDATA:pam_by})?
+
+CRON_ACTION [A-Z ]+
+CRONLOG %{SYSLOGBASE} \(%{USER:user}\) %{CRON_ACTION:action} \(%{DATA:message}\)
+
+SYSLOGLINE %{SYSLOGBASE2} %{GREEDYDATA:message}
+
+# IETF 5424 syslog(8) format (see http://www.rfc-editor.org/info/rfc5424)
+SYSLOG5424PRI <%{NONNEGINT:syslog5424_pri}>
+SYSLOG5424SD \[%{DATA}\]+
+SYSLOG5424BASE %{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(-|%{SYSLOG5424PRINTASCII:syslog5424_app}) +(-|%{SYSLOG5424PRINTASCII:syslog5424_proc}) +(-|%{SYSLOG5424PRINTASCII:syslog5424_msgid}) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|)
+
+SYSLOG5424LINE %{SYSLOG5424BASE} +%{GREEDYDATA:syslog5424_msg}

vendor/github.com/vjeantet/grok/patterns/mcollective

@@ -0,0 +1 @@
+MCOLLECTIVEAUDIT %{TIMESTAMP_ISO8601:timestamp}:

vendor/github.com/vjeantet/grok/patterns/mcollective-patterns

@@ -0,0 +1,4 @@
+# Remember, these can be multi-line events.
+MCOLLECTIVE ., \[%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}\]%{SPACE}%{LOGLEVEL:event_level}
+
+MCOLLECTIVEAUDIT %{TIMESTAMP_ISO8601:timestamp}:

vendor/github.com/vjeantet/grok/patterns/mongodb

@@ -0,0 +1,7 @@
+MONGO_LOG %{SYSLOGTIMESTAMP:timestamp} \[%{WORD:component}\] %{GREEDYDATA:message}
+MONGO_QUERY \{ (?<={ ).*(?= } ntoreturn:) \}
+MONGO_SLOWQUERY %{WORD} %{MONGO_WORDDASH:database}\.%{MONGO_WORDDASH:collection} %{WORD}: %{MONGO_QUERY:query} %{WORD}:%{NONNEGINT:ntoreturn} %{WORD}:%{NONNEGINT:ntoskip} %{WORD}:%{NONNEGINT:nscanned}.*nreturned:%{NONNEGINT:nreturned}..+ (?<duration>[0-9]+)ms
+MONGO_WORDDASH \b[\w-]+\b
+MONGO3_SEVERITY \w
+MONGO3_COMPONENT %{WORD}|-
+MONGO3_LOG %{TIMESTAMP_ISO8601:timestamp} %{MONGO3_SEVERITY:severity} %{MONGO3_COMPONENT:component}%{SPACE}(?:\[%{DATA:context}\])? %{GREEDYDATA:message}

vendor/github.com/vjeantet/grok/patterns/nagios

@@ -0,0 +1,124 @@
+##################################################################################
+##################################################################################
+# Chop Nagios log files to smithereens!
+#
+# A set of GROK filters to process logfiles generated by Nagios.
+# While it does not, this set intends to cover all possible Nagios logs.
+#
+# Some more work needs to be done to cover all External Commands:
+#	http://old.nagios.org/developerinfo/externalcommands/commandlist.php
+#
+# If you need some support on these rules please contact:
+#	Jelle Smet http://smetj.net
+#
+#################################################################################
+#################################################################################
+
+NAGIOSTIME \[%{NUMBER:nagios_epoch}\]
+
+###############################################
+######## Begin nagios log types
+###############################################
+NAGIOS_TYPE_CURRENT_SERVICE_STATE CURRENT SERVICE STATE
+NAGIOS_TYPE_CURRENT_HOST_STATE CURRENT HOST STATE
+
+NAGIOS_TYPE_SERVICE_NOTIFICATION SERVICE NOTIFICATION
+NAGIOS_TYPE_HOST_NOTIFICATION HOST NOTIFICATION
+
+NAGIOS_TYPE_SERVICE_ALERT SERVICE ALERT
+NAGIOS_TYPE_HOST_ALERT HOST ALERT
+
+NAGIOS_TYPE_SERVICE_FLAPPING_ALERT SERVICE FLAPPING ALERT
+NAGIOS_TYPE_HOST_FLAPPING_ALERT HOST FLAPPING ALERT
+
+NAGIOS_TYPE_SERVICE_DOWNTIME_ALERT SERVICE DOWNTIME ALERT
+NAGIOS_TYPE_HOST_DOWNTIME_ALERT HOST DOWNTIME ALERT
+
+NAGIOS_TYPE_PASSIVE_SERVICE_CHECK PASSIVE SERVICE CHECK
+NAGIOS_TYPE_PASSIVE_HOST_CHECK PASSIVE HOST CHECK
+
+NAGIOS_TYPE_SERVICE_EVENT_HANDLER SERVICE EVENT HANDLER
+NAGIOS_TYPE_HOST_EVENT_HANDLER HOST EVENT HANDLER
+
+NAGIOS_TYPE_EXTERNAL_COMMAND EXTERNAL COMMAND
+NAGIOS_TYPE_TIMEPERIOD_TRANSITION TIMEPERIOD TRANSITION
+###############################################
+######## End nagios log types
+###############################################
+
+###############################################
+######## Begin external check types
+###############################################
+NAGIOS_EC_DISABLE_SVC_CHECK DISABLE_SVC_CHECK
+NAGIOS_EC_ENABLE_SVC_CHECK ENABLE_SVC_CHECK
+NAGIOS_EC_DISABLE_HOST_CHECK DISABLE_HOST_CHECK
+NAGIOS_EC_ENABLE_HOST_CHECK ENABLE_HOST_CHECK
+NAGIOS_EC_PROCESS_SERVICE_CHECK_RESULT PROCESS_SERVICE_CHECK_RESULT
+NAGIOS_EC_PROCESS_HOST_CHECK_RESULT PROCESS_HOST_CHECK_RESULT
+NAGIOS_EC_SCHEDULE_SERVICE_DOWNTIME SCHEDULE_SERVICE_DOWNTIME
+NAGIOS_EC_SCHEDULE_HOST_DOWNTIME SCHEDULE_HOST_DOWNTIME
+NAGIOS_EC_DISABLE_HOST_SVC_NOTIFICATIONS DISABLE_HOST_SVC_NOTIFICATIONS
+NAGIOS_EC_ENABLE_HOST_SVC_NOTIFICATIONS ENABLE_HOST_SVC_NOTIFICATIONS
+NAGIOS_EC_DISABLE_HOST_NOTIFICATIONS DISABLE_HOST_NOTIFICATIONS
+NAGIOS_EC_ENABLE_HOST_NOTIFICATIONS ENABLE_HOST_NOTIFICATIONS
+NAGIOS_EC_DISABLE_SVC_NOTIFICATIONS DISABLE_SVC_NOTIFICATIONS
+NAGIOS_EC_ENABLE_SVC_NOTIFICATIONS ENABLE_SVC_NOTIFICATIONS
+###############################################
+######## End external check types
+###############################################
+NAGIOS_WARNING Warning:%{SPACE}%{GREEDYDATA:nagios_message}
+
+NAGIOS_CURRENT_SERVICE_STATE %{NAGIOS_TYPE_CURRENT_SERVICE_STATE:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{DATA:nagios_statetype};%{DATA:nagios_statecode};%{GREEDYDATA:nagios_message}
+NAGIOS_CURRENT_HOST_STATE %{NAGIOS_TYPE_CURRENT_HOST_STATE:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_state};%{DATA:nagios_statetype};%{DATA:nagios_statecode};%{GREEDYDATA:nagios_message}
+
+NAGIOS_SERVICE_NOTIFICATION %{NAGIOS_TYPE_SERVICE_NOTIFICATION:nagios_type}: %{DATA:nagios_notifyname};%{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{DATA:nagios_contact};%{GREEDYDATA:nagios_message}
+NAGIOS_HOST_NOTIFICATION %{NAGIOS_TYPE_HOST_NOTIFICATION:nagios_type}: %{DATA:nagios_notifyname};%{DATA:nagios_hostname};%{DATA:nagios_state};%{DATA:nagios_contact};%{GREEDYDATA:nagios_message}
+
+NAGIOS_SERVICE_ALERT %{NAGIOS_TYPE_SERVICE_ALERT:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{DATA:nagios_statelevel};%{NUMBER:nagios_attempt};%{GREEDYDATA:nagios_message}
+NAGIOS_HOST_ALERT %{NAGIOS_TYPE_HOST_ALERT:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_state};%{DATA:nagios_statelevel};%{NUMBER:nagios_attempt};%{GREEDYDATA:nagios_message}
+
+NAGIOS_SERVICE_FLAPPING_ALERT %{NAGIOS_TYPE_SERVICE_FLAPPING_ALERT:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{GREEDYDATA:nagios_message}
+NAGIOS_HOST_FLAPPING_ALERT %{NAGIOS_TYPE_HOST_FLAPPING_ALERT:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_state};%{GREEDYDATA:nagios_message}
+
+NAGIOS_SERVICE_DOWNTIME_ALERT %{NAGIOS_TYPE_SERVICE_DOWNTIME_ALERT:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{GREEDYDATA:nagios_comment}
+NAGIOS_HOST_DOWNTIME_ALERT %{NAGIOS_TYPE_HOST_DOWNTIME_ALERT:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_state};%{GREEDYDATA:nagios_comment}
+
+NAGIOS_PASSIVE_SERVICE_CHECK %{NAGIOS_TYPE_PASSIVE_SERVICE_CHECK:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{GREEDYDATA:nagios_comment}
+NAGIOS_PASSIVE_HOST_CHECK %{NAGIOS_TYPE_PASSIVE_HOST_CHECK:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_state};%{GREEDYDATA:nagios_comment}
+
+NAGIOS_SERVICE_EVENT_HANDLER %{NAGIOS_TYPE_SERVICE_EVENT_HANDLER:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{DATA:nagios_statelevel};%{DATA:nagios_event_handler_name}
+NAGIOS_HOST_EVENT_HANDLER %{NAGIOS_TYPE_HOST_EVENT_HANDLER:nagios_type}: %{DATA:nagios_hostname};%{DATA:nagios_state};%{DATA:nagios_statelevel};%{DATA:nagios_event_handler_name}
+
+NAGIOS_TIMEPERIOD_TRANSITION %{NAGIOS_TYPE_TIMEPERIOD_TRANSITION:nagios_type}: %{DATA:nagios_service};%{DATA:nagios_unknown1};%{DATA:nagios_unknown2}
+
+####################
+#### External checks
+####################
+
+#Disable host & service check
+NAGIOS_EC_LINE_DISABLE_SVC_CHECK %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_DISABLE_SVC_CHECK:nagios_command};%{DATA:nagios_hostname};%{DATA:nagios_service}
+NAGIOS_EC_LINE_DISABLE_HOST_CHECK %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_DISABLE_HOST_CHECK:nagios_command};%{DATA:nagios_hostname}
+
+#Enable host & service check
+NAGIOS_EC_LINE_ENABLE_SVC_CHECK %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_ENABLE_SVC_CHECK:nagios_command};%{DATA:nagios_hostname};%{DATA:nagios_service}
+NAGIOS_EC_LINE_ENABLE_HOST_CHECK %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_ENABLE_HOST_CHECK:nagios_command};%{DATA:nagios_hostname}
+
+#Process host & service check
+NAGIOS_EC_LINE_PROCESS_SERVICE_CHECK_RESULT %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_PROCESS_SERVICE_CHECK_RESULT:nagios_command};%{DATA:nagios_hostname};%{DATA:nagios_service};%{DATA:nagios_state};%{GREEDYDATA:nagios_check_result}
+NAGIOS_EC_LINE_PROCESS_HOST_CHECK_RESULT %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_PROCESS_HOST_CHECK_RESULT:nagios_command};%{DATA:nagios_hostname};%{DATA:nagios_state};%{GREEDYDATA:nagios_check_result}
+
+#Disable host & service notifications
+NAGIOS_EC_LINE_DISABLE_HOST_SVC_NOTIFICATIONS %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_DISABLE_HOST_SVC_NOTIFICATIONS:nagios_command};%{GREEDYDATA:nagios_hostname}
+NAGIOS_EC_LINE_DISABLE_HOST_NOTIFICATIONS %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_DISABLE_HOST_NOTIFICATIONS:nagios_command};%{GREEDYDATA:nagios_hostname}
+NAGIOS_EC_LINE_DISABLE_SVC_NOTIFICATIONS %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_DISABLE_SVC_NOTIFICATIONS:nagios_command};%{DATA:nagios_hostname};%{GREEDYDATA:nagios_service}
+
+#Enable host & service notifications
+NAGIOS_EC_LINE_ENABLE_HOST_SVC_NOTIFICATIONS %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_ENABLE_HOST_SVC_NOTIFICATIONS:nagios_command};%{GREEDYDATA:nagios_hostname}
+NAGIOS_EC_LINE_ENABLE_HOST_NOTIFICATIONS %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_ENABLE_HOST_NOTIFICATIONS:nagios_command};%{GREEDYDATA:nagios_hostname}
+NAGIOS_EC_LINE_ENABLE_SVC_NOTIFICATIONS %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_ENABLE_SVC_NOTIFICATIONS:nagios_command};%{DATA:nagios_hostname};%{GREEDYDATA:nagios_service}
+
+#Schedule host & service downtime
+NAGIOS_EC_LINE_SCHEDULE_HOST_DOWNTIME %{NAGIOS_TYPE_EXTERNAL_COMMAND:nagios_type}: %{NAGIOS_EC_SCHEDULE_HOST_DOWNTIME:nagios_command};%{DATA:nagios_hostname};%{NUMBER:nagios_start_time};%{NUMBER:nagios_end_time};%{NUMBER:nagios_fixed};%{NUMBER:nagios_trigger_id};%{NUMBER:nagios_duration};%{DATA:author};%{DATA:comment}
+
+#End matching line
+NAGIOSLOGLINE %{NAGIOSTIME} (?:%{NAGIOS_WARNING}|%{NAGIOS_CURRENT_SERVICE_STATE}|%{NAGIOS_CURRENT_HOST_STATE}|%{NAGIOS_SERVICE_NOTIFICATION}|%{NAGIOS_HOST_NOTIFICATION}|%{NAGIOS_SERVICE_ALERT}|%{NAGIOS_HOST_ALERT}|%{NAGIOS_SERVICE_FLAPPING_ALERT}|%{NAGIOS_HOST_FLAPPING_ALERT}|%{NAGIOS_SERVICE_DOWNTIME_ALERT}|%{NAGIOS_HOST_DOWNTIME_ALERT}|%{NAGIOS_PASSIVE_SERVICE_CHECK}|%{NAGIOS_PASSIVE_HOST_CHECK}|%{NAGIOS_SERVICE_EVENT_HANDLER}|%{NAGIOS_HOST_EVENT_HANDLER}|%{NAGIOS_TIMEPERIOD_TRANSITION}|%{NAGIOS_EC_LINE_DISABLE_SVC_CHECK}|%{NAGIOS_EC_LINE_ENABLE_SVC_CHECK}|%{NAGIOS_EC_LINE_DISABLE_HOST_CHECK}|%{NAGIOS_EC_LINE_ENABLE_HOST_CHECK}|%{NAGIOS_EC_LINE_PROCESS_HOST_CHECK_RESULT}|%{NAGIOS_EC_LINE_PROCESS_SERVICE_CHECK_RESULT}|%{NAGIOS_EC_LINE_SCHEDULE_HOST_DOWNTIME}|%{NAGIOS_EC_LINE_DISABLE_HOST_SVC_NOTIFICATIONS}|%{NAGIOS_EC_LINE_ENABLE_HOST_SVC_NOTIFICATIONS}|%{NAGIOS_EC_LINE_DISABLE_HOST_NOTIFICATIONS}|%{NAGIOS_EC_LINE_ENABLE_HOST_NOTIFICATIONS}|%{NAGIOS_EC_LINE_DISABLE_SVC_NOTIFICATIONS}|%{NAGIOS_EC_LINE_ENABLE_SVC_NOTIFICATIONS})

vendor/github.com/vjeantet/grok/patterns/postgresql

@@ -0,0 +1,3 @@
+# Default postgresql pg_log format pattern
+POSTGRESQL %{DATESTAMP:timestamp} %{TZ} %{DATA:user_id} %{GREEDYDATA:connection_id} %{POSINT:pid}
+

vendor/github.com/vjeantet/grok/patterns/rails

@@ -0,0 +1,13 @@
+RUUID \h{32}
+# rails controller with action
+RCONTROLLER (?<controller>[^#]+)#(?<action>\w+)
+
+# this will often be the only line:
+RAILS3HEAD (?m)Started %{WORD:verb} "%{URIPATHPARAM:request}" for %{IPORHOST:clientip} at (?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND} %{ISO8601_TIMEZONE})
+# for some a strange reason, params are stripped of {} - not sure that's a good idea.
+RPROCESSING \W*Processing by %{RCONTROLLER} as (?<format>\S+)(?:\W*Parameters: {%{DATA:params}}\W*)?
+RAILS3FOOT Completed %{NUMBER:response}%{DATA} in %{NUMBER:totalms}ms %{RAILS3PROFILE}%{GREEDYDATA}
+RAILS3PROFILE (?:\(Views: %{NUMBER:viewms}ms \| ActiveRecord: %{NUMBER:activerecordms}ms|\(ActiveRecord: %{NUMBER:activerecordms}ms)?
+
+# putting it all together
+RAILS3 %{RAILS3HEAD}(?:%{RPROCESSING})?(?<context>(?:%{DATA}\n)*)(?:%{RAILS3FOOT})?

vendor/github.com/vjeantet/grok/patterns/redis

@@ -0,0 +1,3 @@
+REDISTIMESTAMP %{MONTHDAY} %{MONTH} %{TIME}
+REDISLOG \[%{POSINT:pid}\] %{REDISTIMESTAMP:timestamp} \* 
+

vendor/github.com/vjeantet/grok/patterns/ruby

@@ -0,0 +1,2 @@
+RUBY_LOGLEVEL (?:DEBUG|FATAL|ERROR|WARN|INFO)
+RUBY_LOGGER [DFEWI], \[%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}\] *%{RUBY_LOGLEVEL:loglevel} -- +%{DATA:progname}: %{GREEDYDATA:message}