Parse files with multiple root nodes.
Escape all escaped characters, not just spaces.
Parse custom variables

If there were any custom variables in the OSSEC policy, they were not being parsed; the variable names were simply printed as-is.

e.g. in 50_syslog_rules.xml, there is a variable:

<var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var>

and rule 1002 used this:

<rule id="1002" level="2">
  <match>$BAD_WORDS</match>
  <options>alert_by_email</options>
  <description>Unknown problem somewhere in the system.</description>
</rule>

but it was just being converted to the json as is:

{
  "name": "Unknown problem somewhere in the system. (1002)",
  "search_pattern": "$BAD_WORDS",
  ...
}
Merge pull request #2 from dead10ck/master

Parse files with multiple root nodes; escape all escaped characters; parse custom variables.