mcollective-patterns 190 B

1234
  1. # Remember, these can be multi-line events.
  2. MCOLLECTIVE ., \[%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}\]%{SPACE}%{LOGLEVEL:event_level}
  3. MCOLLECTIVEAUDIT %{TIMESTAMP_ISO8601:timestamp}: