Required fields are in bold.
Fluentd syslog parser for the RFC3164 format (ie. BSD-syslog messages) Reference: https://docs.fluentd.org/parser/syslog#rfc3164-log​
Column | Type | Description |
|
| Priority is calculated by (Facility * 8 + Severity). The lower this value, the higher importance of the log message. |
|
| Hostname identifies the machine that originally sent the syslog message. |
|
| Appname identifies the device or application that originated the syslog message. |
|
| ProcID is often the process ID, but can be any value used to enable log analyzers to detect discontinuities in syslog reporting. |
|
| Message contains free-form text that provides information about the event. |
|
| Timestamp of the syslog message in UTC. |
|
| Tag of the syslog message |
|
| Panther added field with type of log |
|
| Panther added field with unique id (within table) |
|
| Panther added standardize event time (UTC) |
|
| Panther added standardize log parse time (UTC) |
|
| Panther added field with the source id |
|
| Panther added field with the source label |
|
| Panther added field with collection of ip addresses associated with the row |
|
| Panther added field with collection of domain names associated with the row |
|
| Panther added field with collection of SHA1 hashes associated with the row |
|
| Panther added field with collection of MD5 hashes associated with the row |
|
| Panther added field with collection of SHA256 hashes of any algorithm associated with the row |
Fluentd syslog parser for the RFC5424 format (ie. BSD-syslog messages) Reference: https://docs.fluentd.org/parser/syslog#rfc5424-log​
Column | Type | Description |
|
| Priority is calculated by (Facility * 8 + Severity). The lower this value, the higher importance of the log message. |
|
| Hostname identifies the machine that originally sent the syslog message. |
|
| Appname identifies the device or application that originated the syslog message. |
|
| ProcID is often the process ID, but can be any value used to enable log analyzers to detect discontinuities in syslog reporting. |
|
| MsgID identifies the type of message. For example, a firewall might use the MsgID 'TCPIN' for incoming TCP traffic. |
|
| ExtraData contains syslog strucured data as string |
|
| Message contains free-form text that provides information about the event. |
|
| Timestamp of the syslog message in UTC. |
|
| Tag of the syslog message |
|
| Panther added field with type of log |
|
| Panther added field with unique id (within table) |
|
| Panther added standardize event time (UTC) |
|
| Panther added standardize log parse time (UTC) |
|
| Panther added field with the source id |
|
| Panther added field with the source label |
|
| Panther added field with collection of ip addresses associated with the row |
|
| Panther added field with collection of domain names associated with the row |
|
| Panther added field with collection of SHA1 hashes associated with the row |
|
| Panther added field with collection of MD5 hashes associated with the row |
|
| Panther added field with collection of SHA256 hashes of any algorithm associated with the row |