1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

  
<Extension _json>
    Module  xm_json
</Extension>

<Extension _syslog>
    Module  xm_syslog
</Extension>

<Input in>
    Module  im_udp
    Host    0.0.0.0
    Port    1514
    <Exec>
      parse_syslog_bsd();
      if ( $Message =~ /^CisACS_(\d\d)_(\S+) (\S+) (\d+) (\d+) (.*)$/ )
      {
        $ACSCategoryNumber = $1;
        $ACSCategoryName = $2;
        $ACSMessageId = $3;
        $ACSTotalSegments = $4;
        $ACSSegmentNumber = $5;
        $ACSMessage = $6;
        if ( $ACSMessage =~ /Message-Type=([^\,]+)/ ) $ACSMessageType = $1;
        if ( $ACSMessage =~ /User-Name=([^\,]+)/ ) $AccountName = $1;
        if ( $ACSMessage =~ /NAS-IP-Address=([^\,]+)/ ) $ACSNASIPAddress = $1;
        if ( $ACSMessage =~ /AAA Server=([^\,]+)/ ) $ACSAAAServer = $1;
      }
      else log_warning("Does not match: " + $raw_event);
    </Exec>
</Input>

<Output out>
    Module  om_file
    File    "tmp/output.txt"
    Exec    to_json();
</Output>