#
# parse auth.log for user-names and public keys
#

[PARSER]
    name   syslog_msg
    format regex
    # there might be more than one space after month name
    regex  ^[^ ]+ +[^ ]+ [^ ]+ [^ ]+ (?<msg>.*)$

[PARSER]
    name   ssh_pubkey
    format regex
    regex  ^sshd.*: Accepted publickey for (?<user>[^ ]+) from (?<src_ip>[0-9.]+) port [0-9]+ (?<ssh_proto>[^:]+): (?<algo>[^ ]+) (?<pubkey>.*)$

# regex against proc_name[proc_pid]: situation
[PARSER]
    name   name_pid_msg
    format regex
    regex  ^(?<proc_name>[^\[]+)\[(?<proc_pid>[0-9]+)\]: (?<proc_msg>.*)$

# regex against proc_name: situation
[PARSER]
    name   name_msg
    format regex
    regex  ^(?<proc_name>[^\[:]+): (?<proc_msg>.*)$