From bcca33c2b5583c1aec65ee755fd07eff97dd3c18 Mon Sep 17 00:00:00 2001
From: Alex Macocian <amacocian@yahoo.com>
Date: Fri, 1 Aug 2025 11:25:08 +0200
Subject: [PATCH] Use RFC5424 logging handler

---
 logstash/conf.d/30-syslog.conf | 40 +++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/logstash/conf.d/30-syslog.conf b/logstash/conf.d/30-syslog.conf
index bf89e96..4437e3a 100644
--- a/logstash/conf.d/30-syslog.conf
+++ b/logstash/conf.d/30-syslog.conf
@@ -12,12 +12,42 @@ input {
 filter {
   if [type] == "syslog" {
     grok {
-      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
-      add_field => [ "received_at", "%{@timestamp}" ]
-      add_field => [ "received_from", "%{host}" ]
+      match => {
+        "message" => "<%{NONNEGINT:syslog_pri}>%{NONNEGINT:version}%{SPACE}(?:-|%{TIMESTAMP_ISO8601:syslog_timestamp})%{SPACE}(?:-|%{IPORHOST:hostname})%{SPACE}(?:%{SYSLOG5424PRINTASCII:program}|-)%{SPACE}(?:-|%{SYSLOG5424PRINTASCII:process_id})%{SPACE}(?:-|%{SYSLOG5424PRINTASCII:message_id})%{SPACE}(?:-|(?<structured_data>(\[.*?[^\\]\])+))(?:%{SPACE}%{GREEDYDATA:syslog_message}|)"
+      }
+      add_tag => [ "match" ]
     }
-    date {
-      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
+    if "match" in [tags] {
+      syslog_pri {
+        remove_field => "syslog_pri"
+      }
+      date {
+        match => [ "syslog_timestamp", "ISO8601", "MMM dd HH:mm:ss", "MMM dd HH:mm:ss.SSS" ]
+        remove_field => "syslog_timestamp"
+      }
+      if [structured_data] {
+        ruby {
+          code => '
+            # https://github.com/logstash-plugins/logstash-input-syslog/issues/15#issuecomment-270367033
+            def extract_syslog5424_sd(syslog5424_sd)
+              sd = {}
+              syslog5424_sd.scan(/\[(?<element>.*?[^\\])\]/) do |element|
+                data = element[0].match(/(?<sd_id>[^\ ]+)(?<sd_params> .*)?/)
+                sd_id = data[:sd_id].split("@", 2)[0]
+                sd[sd_id] = {}
+                next if data.nil? || data[:sd_params].nil?
+                data[:sd_params].scan(/ (.*?[=](?:""|".*?[^\\]"))/) do |set|
+                  set = set[0].match(/(?<param_name>.*?)[=]\"(?<param_value>.*)\"/)
+                  sd[sd_id][set[:param_name]] = set[:param_value]
+                end
+              end
+              sd
+            end
+            event.set("[sd]", extract_syslog5424_sd(event.get("[structured_data]")))
+          '
+          remove_field => "structured_data"
+        }
+      }
     }
   }
 }
\ No newline at end of file