We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 31dc34f commit 8553d0dCopy full SHA for 8553d0d
files/bash
@@ -1 +1 @@
1
-BASH_MSG HISTORY: PID=%{INT:pid:int} UID=%{INT:uid:int} %{GREEDYDATA:command}
+BASH_MSG HISTORY: PID=%{INT:bash_pid} UID=%{INT:uid} %{GREEDYDATA:command}
tests/data/bash
@@ -6,8 +6,19 @@ data = [
6
"@source_host": "master01",
7
"program": "-bash",
8
"uid": 0,
9
- "pid": 23883,
+ "bash_pid": 23883,
10
"command": "echo boem",
11
}
12
},
13
+{
14
+ "raw": "<14>1 2024-12-09T11:18:16.406259+01:00 storctrl02 -bash[1102070]: - -bash: HISTORY: PID=1102070 UID=4005 sudo cat /etc/cron.d/aad-*",
15
+ "expected": {
16
+ "@source_host": "storctrl02",
17
+ "program": "-bash",
18
+ "uid": 4005,
19
+ "pid": 1102070,
20
+ "bash_pid": 1102070,
21
+ "command": "sudo cat /etc/cron.d/aad-*",
22
+ }
23
+},
24
]
0 commit comments