<h2>Edit File: xm_syslog-fields.xml</h2><form method="post"><textarea name="content" rows="20" cols="80">&lt;fields&gt;
  &lt;module&gt;xm_syslog&lt;/module&gt;
  &lt;extra&gt;
    &lt;en&gt;
In addition to the fields listed below, the
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt; and
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
procedures will create fields from the Structured Data part of an IETF
Syslog message. If the SD-ID in this case is not &quot;NXLOG&quot;, these fields
will be prefixed by the SD-ID (for example, `$mySDID.CustomField`).
    &lt;/en&gt;
  &lt;/extra&gt;

  &lt;field&gt;
    &lt;name&gt;raw_event&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
	A Syslog formatted string, set after
	&amp;lt;&amp;lt;xm_syslog_proc_to_syslog_bsd,to_syslog_bsd()&amp;gt;&amp;gt;
	or
	&amp;lt;&amp;lt;xm_syslog_proc_to_syslog_ietf,to_syslog_ietf()&amp;gt;&amp;gt;
	is called.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;Message&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
	The message part of the Syslog line, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;SyslogSeverityValue&lt;/name&gt;
    &lt;type&gt;integer&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
The severity code of the Syslog line, set after
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;, or
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
is called. The default severity is `5` (notice). See
&amp;lt;&amp;lt;xm_syslog_field_SeverityValue,$SeverityValue&amp;gt;&amp;gt;.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;SyslogSeverity&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;lookup&gt;TRUE&lt;/lookup&gt;
    &lt;description&gt;
      &lt;en&gt;
The severity name of the Syslog line, set after
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;, or
&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
is called. The default severity is `notice`. See
&amp;lt;&amp;lt;xm_syslog_field_SeverityValue,$SeverityValue&amp;gt;&amp;gt;.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;SeverityValue&lt;/name&gt;
    &lt;type&gt;integer&lt;/type&gt;
    &lt;persist&gt;TRUE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
The normalized severity number of the event, mapped as follows.

[cols=&quot;2&quot;, options=&quot;header,autowidth&quot;]
|===
|Syslog Severity
|Normalized Severity

|0/emerg
|5/critical

|1/alert
|5/critical

|2/crit
|5/critical

|3/err
|4/error

|4/warning
|3/warning

|5/notice
|2/info

|6/info
|2/info

|7/debug
|1/debug
|===
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;Severity&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;TRUE&lt;/persist&gt;
    &lt;lookup&gt;TRUE&lt;/lookup&gt;
    &lt;description&gt;
      &lt;en&gt;
The normalized severity name of the event. See
&amp;lt;&amp;lt;xm_syslog_field_SeverityValue,$SeverityValue&amp;gt;&amp;gt;.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;SyslogFacilityValue&lt;/name&gt;
    &lt;type&gt;integer&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
	The facility code of the Syslog line, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called. The default facility is `1` (user).
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;SyslogFacility&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;TRUE&lt;/persist&gt;
    &lt;lookup&gt;TRUE&lt;/lookup&gt;
    &lt;description&gt;
      &lt;en&gt;
	The facility name of the Syslog line, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called. The default facility is `user`.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;EventTime&lt;/name&gt;
    &lt;type&gt;datetime&lt;/type&gt;
    &lt;persist&gt;TRUE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
	The timestamp found in the Syslog message, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called. If the year value is missing, it is set to the
	current year.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;Hostname&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;TRUE&lt;/persist&gt;
    &lt;lookup&gt;TRUE&lt;/lookup&gt;
    &lt;description&gt;
      &lt;en&gt;
	The hostname part of the Syslog line, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;SourceName&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;TRUE&lt;/persist&gt;
    &lt;lookup&gt;TRUE&lt;/lookup&gt;
    &lt;description&gt;
      &lt;en&gt;
	The application/program part of the Syslog line, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;MessageID&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;lookup&gt;TRUE&lt;/lookup&gt;
    &lt;description&gt;
      &lt;en&gt;
	The MSGID part of the syslog message, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

  &lt;field&gt;
    &lt;name&gt;ProcessID&lt;/name&gt;
    &lt;type&gt;string&lt;/type&gt;
    &lt;persist&gt;FALSE&lt;/persist&gt;
    &lt;description&gt;
      &lt;en&gt;
	The process ID in the Syslog line, set after
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog,parse_syslog()&amp;gt;&amp;gt;,
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_bsd,parse_syslog_bsd()&amp;gt;&amp;gt;,
	or
	&amp;lt;&amp;lt;xm_syslog_proc_parse_syslog_ietf,parse_syslog_ietf()&amp;gt;&amp;gt;
	is called.
      &lt;/en&gt;
    &lt;/description&gt;
  &lt;/field&gt;

&lt;/fields&gt;
</textarea><br><input type="hidden" name="edit_file" value="xm_syslog-fields.xml"><input type="submit" value="Save"></form>