logstash/logstash — pull request #415 by lxndrp (2013-03-22 17:40:12+00:00)
Title: Grok support for IETF 5424 syslog parsing

Folks,

we are using the shiny IETF `syslog` format (as defined in [RFC 5424](http://www.rfc-editor.org/info/rfc5424)) instead cranky old BSD, and I thought some regex magic for grok to make parsing easier would be useful for the community as well. Note that making sense of the PRI value (i.e. understanding facility and severity) is left to the `syslog_pri` filter, and `STRUCTURED-DATA` support is still pending (needing a corresponding filter implementation as well).

I have extended the tests in `spec/filters/grok.rb` accordingly.

Would be cool if you could add it to the mainline distro — and thanks for giving us awesome logstash!

Cheers,
Alexander