From dd92b6f887c18c40932969d9430be9d54d7f6903 Mon Sep 17 00:00:00 2001 From: Pier-Hugues Pellerin Date: Mon, 18 Feb 2019 08:26:50 -0500 Subject: [PATCH] Adding Cisco support for the Syslog parser (#10760) * Adding Cisco support for the Syslog parser Add support for the "sequence" number in the log format send by Cisco switch devices. Fixes: #10654 --- CHANGELOG.next.asciidoc | 3 +- filebeat/_meta/fields.common.yml | 6 + filebeat/docs/fields.asciidoc | 12 + filebeat/include/fields.go | 2 +- filebeat/input/syslog/event.go | 13 + filebeat/input/syslog/input.go | 5 + filebeat/input/syslog/input_test.go | 26 + filebeat/input/syslog/parser.go | 2337 +++++++++++++++-------- filebeat/input/syslog/parser.rl | 27 +- filebeat/input/syslog/parser_test.go | 109 ++ filebeat/input/syslog/syslog_rfc3164.rl | 11 +- 11 files changed, 1711 insertions(+), 840 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 5cb24e52e0de..cafbbbce152f 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -81,7 +81,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - The `elasticsearch/deprecation` fileset now indexes the `component` field under `elasticsearch` instead of `elasticsearch.server`. {pull}10445[10445] - Remove field `kafka.log.trace.full` from kafka.log fielset. {pull}10398[10398] - Change field `kafka.log.class` for kafka.log fileset from text to keyword. {pull}10398[10398] -- Address add_kubernetes_metadata processor issue where old source field is +- Address add_kubernetes_metadata processor issue where old source field is still used for matcher. {issue}10505[10505] {pull}10506[10506] - Change type of haproxy.source from text to keyword. {pull}10506[10506] - Rename `event.type` to `suricata.eve.event_type` in Suricata module because event.type is reserved for future use by ECS. {pull}10575[10575] @@ -185,6 +185,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211] - Fixed data types for roles and indices fields in `elasticsearch/audit` fileset {pull}10307[10307] - Ensure `source.address` is always populated by the nginx module (ECS). {pull}10418[10418] +- Add support for Cisco syslog format used by their switch. {pull}10760[10760] - Cover empty request data, url and version in Apache2 module{pull}10730[10730] - Fix registry entries not being cleaned due to race conditions. {pull}10747[10747] - Improve detection of file deletion on Windows. {pull}10747[10747] diff --git a/filebeat/_meta/fields.common.yml b/filebeat/_meta/fields.common.yml index 9f197949a118..770d781f437e 100644 --- a/filebeat/_meta/fields.common.yml +++ b/filebeat/_meta/fields.common.yml @@ -35,6 +35,12 @@ The input type from which the event was generated. This field is set to the value specified for the `type` option in the input section of the Filebeat config file. + - name: event.sequence + type: long + required: false + description: > + The sequence number of this event. + - name: syslog.facility type: long required: false diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 0ca41a546a3f..6df8c5610567 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -6585,6 +6585,18 @@ required: True The input type from which the event was generated. This field is set to the value specified for the `type` option in the input section of the Filebeat config file. +-- + +*`event.sequence`*:: ++ +-- +type: long + +required: False + +The sequence number of this event. + + -- *`syslog.facility`*:: diff --git a/filebeat/include/fields.go b/filebeat/include/fields.go index 633614a8eef5..4227fc3d3eaf 100644 --- a/filebeat/include/fields.go +++ b/filebeat/include/fields.go @@ -32,5 +32,5 @@ func init() { // AssetFieldsYml returns asset data. // This is the base64 encoded gzipped contents of fields.yml. func AssetFieldsYml() string { - return "eJzsfftz3Dhy8O/7V6C0VZ/tZEQ9LD9WqfsSnR9r1dpexbKzueRSGgyJmcGKBLgAqPFskv/9K3QDIEByRqPH+Db55Ku6tTkk0Gg0Gv3uXXLJlseE5fo7Qgw3JTsmb16df0dIwXSueG24FMfk/35HCLE/kClnZaGz74j72/F38NMuEbRix2TnnwyvmDa0qnfgB0LMsmbHpKCGuQclu2LlMcml8k8U+63hihXHxKjGP2RfaVVbeHYO9w+e7+4/2z18+nn/5fH+s+OnR9nLZ0//zc8wAKr985oatmfBIYs5E8TMGWFXTBgiFZ9xQQ0rsu/C22+lIqWc4SuamDnXhGv4qlg10IJqMmOCKTvWiFBRhOGENPg2x9cUo/Fsn9yKEYtkKhWhZekmz1KcGjrTK1GH2L1ky4VURQ9z//7XnVrJosktbv66MyJ/3WHi6vCvO/9xDe7ec22InPqBNWk0K4iRFhjCaD5HUDuQlnTCyutglZNfWW66oP4nE1fHpAV2RGhdlzynCNlUyt0JVf+9Huqf2HLvipYNIzXlSkf4fkUFmbCwCloUpGKGEi6mUlUwiX3u8E/O57IpC9jEXApDuSCCacPa/cVV6IyclCWBOTWhihFtpN1Wqj3qIiDe+MWOC5lfMjW2FEPGly/12KGug8+KaU1nq88NItSwrz107rxjZSnJL1KVxTVb3SN85ud1xOkwgD/ZN93P0cpOBZFmzpRFMMmpZoPjpHuQS5FTw0TLGAgp+HTKlD1aDqWLOc/ngFhjD9NUMVYuiWZU5XM6KVlGTqekakrD67Idxs2rCfvKtRnZb5d++lxWEy5YQbgwkkjBOsvxuKczJjxaHWM8iR7NlGzqY3K4Href5wwHctwyUJNjK5TQiWwM/FPLqVnYlTJhuFmOCJ8SKpYWemrJsCwtwY1IwQz+RSoiJ5qpK7tQ3DwpCCVzadcsFTH0kmlSMaobxar0hcxToyZc5GVTMPJnRoGgZ/BmRZeElloS1Qj7mZtK6QzuAVhV9nd+XXpu2deEkVrWTWnZIVlwM7fAUl5qy0pMwIVqhOBiZke1Dy040WKU5Zu44Y7NzmldM7tldk1AVmFFwFvtOkXmkD6V0ghpWLwNfqnHllDtCJZELUywZOC+pZzpUQtjZonA8v8pL9mEUZPBOTk5+zCyHB0vhjB+uiy3vbSu9+yCeM6yiBBijlNIppHJzKmYMcKn7UmwxME10fYbM1eymc3Jbw1r7Ax6qQ2rNCn5JSM/0eklHZFPrOBIFLWSOdM6ejGMqht7mjR5L2faUD0nuCZyDojPErYCFO6RGt/18SmxBMGlCM+HuBRZcU2tOTf2z7/g0AnpRCwnYnbPs/1sf1flh3347P9vA7iPljxWQmYPPooPFCBwRxgZ0IxfMbhsqHCf4tvu5zkr62lTxrSAZK38golZSPLW0SXhQhsqcnf9dI6WtpPb85WMNWmM5QJNRQXIJZaREs1qqpAsuSaCscIeOOE4cG+6ZEBPrLms7ORTJasOPk6nREjiDxWgAE+bfySnhglSsqkhrKrNMhva6KmU/S22u7eNLf68rK/ZYn+k7eBEG7rUhJYL+5+Ae3vBaxQmwtZPlhEvtLdhlqJKBPYUsN6+v4Cx3DQT1r4CvJpPLXEkw60mlIRIKprPuWDDaHdD9HHPi21g/ovgvzWM8MLehFPOFG6DPU6Ag8d8Chc33O76SWdfgpRlGTYyePh24XcB2DkvBpf6kh5Nn+3vF/2lsnrOKqZoeTG0aPbVMFGw4m4Lf+PnuO3ake1YwVVVtCyX7mLRhOZKaquFaEOVFR4sDxgjWfNiHG6idUiZfpdKSHnJeyLSq/jZZjLSiRvIcoGCTUE2o3iEuOCGUyMBCZQIZhZSXVohSjDQEpAtouyj2IyqAm49e/tJoUfRm3g1TnjBFT6gJZmWckEUy62Cg/f751dnbjjkTi1kPXDsA/t6BAxwec1Ega+f/+UjqWl+ycxj/QTHRyG5VtLIXJa9SVCXtPvWmU6BisyscuHFC48Mo6jQFADIyLmsWJAOrCxu3zRMVWTHK71S7djLR7EpU8n0orMcjVKL+9nJebiHExYEu0h+hWmJBUXM/A62g8cwo+7oiMUPbblSoxtYfitFcmFB+rURiGIQKp2Y6EwRZGCcFpFWumpHs+SCW7ILBzdVuO0fN9aen0SxWjErhMHViLe01R41q6gwPAeJnn017kJnX/HEjdy9yXW40I0kV9yuj//OWvnfro8p0Ak0Nw11mD+dkqVsVBh9SstSIxpBkjBsJtVyZF/y94s2vCwJE1Y0dqQoG5XjHVQwbezuWxxaBE15WdpzVtdK1opTw8rlLcQ/WhSKab0tfgjkjDqAIyQ3obvEAruoJnzWyEaXSyRaZ57hZZmMp2XFwD5FSq6N3a/TsxGhpJCV3QCpCCWN4F+Jtvq5yQj5S4tfvHPT8ayyD3up6MLD5ol9nLkHY8RfX3wA41ArHRQNGjxQPR5nvB5bkMYZgje2ql/NROHkOyCwZEh7L4Bykg3c1PWGN3Xy4pq9OT0LC3bcELeos0xneLGgSRU0dXJ6dnVkH5yeXT1vN3UA7loqsyHkpRSzzWA/k8qshDoYX2i+DeHmw8mraxHnQcCN3wYUjs3hBNHM35MPzCie6x4sk6VhAwd9k51Ahbc/RBAwDl4ebQb2n+0IqBNbJSO+YozEW8hpsn1CArZ/yxW0kB5uSGE42+1AnbFYhHeS1Y/Jw45odQ00PzIZDFDUqhdKLWPzEyW6Zjmf8pyUEk2uRLHSsyJ7r121Yh3+kcrCmZozmOJX9pa16wXm6jlfF73x5UKGLpjIpuwASiYf3rowOpMXteQdgNfgh5D3Usy4aQq8LUtq4B+pYhaI4NF/kp1Sip1jsvviafb84Ojl0/0R2Smp2TkmR8+yZ/vPfjh4Sf770dB67I3OBRPmomObuG5V/fN9zZpiG0WYdcWSPkpl5uSkYorndBjsRhi13DrQr3AemHUFrK+ooMUgkIrNuBRbh/ETTLMOxH9u2ITlg3jk5hsgkZu1GPwghVGMlus2mmt5kcvim2z26fnPxM61asNP1mz2t4DTbfi1YO7+86shSFdt94CQfGsQv2imdr08HL2JmrNnoiPijEmo/cgpmSkqmpIqSzHOTaIYXgsdSQ62CyXVYLhD7sIVXiY5E4Ypp9VOSykVEU01YQp8GWDE8Pqj7gyNIJakni81t3/xTpDck7LugfNRgunNvl4u0a3EBaGNkRXcXDMm/bpX7NhEaiPFbpF3DRuyKbp2jfbRZmaNt3jfRtcoSgCyAT8GF1NFtVFNbprY2dEixu5DYlDFx9f4N6ZOgEOTn44NwlSQN68O0d1ib7kpM/mcadw7uLN5ND16kVqY7UWfugIT/xXXwYSYAhEGVI1w/ifFKmmCyZHIxmhesGiuYegoce6UeMjY4wIfO+pLPZc4bDsUeJHc9LEjx02QIu56vdh/HmRNJa94wdRGenGgRpYf3k2oTy58WLEHJHj7Ylc1yw9HZJazEZEqZTR8xg0tZc6oGBBP6RXlJZ3w0l5lv0sxYH1ft8xG7zKqze5BfrfVnkRgkN9B9/XeCiBHoPN2IwcWgjfIRtCvgq+/qs2AdzfKTSH2NvzsjjboADbfPTh8evTs+YuXP+zTSV6w6f6G6r+DhJy+9iQH4Ac/wmrYh31y92MxCmBF19N1gPlfhh1Jt8GqOcwqVvCm2tAk4DlR5HG6Bmaag5x2b3Tw/PnzFy9evHz58ocfftgM6M8tt0ZYwIWvZlTw350bsQixHs6dsWwDPNIL2V72HEIRCEUj0a5hggpDmLjiSoqqb1lqL72TX84DELwYkR+lnJUM72zy86cfyWmB0RIYogLepWSo1tvSCQJxF0jg5F4a6DzeTCIIX6UWb2eW7oUjRZZ1r5x3wSFo53XuCWfuldN4GLCHauannLOytmIxiiV4I06ojoglzKG9Hr+0DMnwVpu4gYHYfbmt4/4JhycVFXRmb2vgo2EJg94sjL36xr7MABLhxRBvrOhsu4wxlg1gtmAWQLAWVJNJw0sDAs8KAA2dbQu+9nA46OjQ/bdNDLUQoObcmzyJbtxk+iTSkYSgwYvb3GuAlMEgwci1k3Kp170fNuNT0XcbuP1izxLommho3XPxoWsGvYHDDzlbG3tM/qhuqsTP9uCr+sP6qqJ9+p/msBoG/dt7rdbDsT3XVcxJ/jf4r2KW4T1DwO/+oE6sm8D74Ml68GT1V/XgyXrwZG2KxAdP1oMn68GTdVtPFguCUJLbSTbWBT8wQ3fjmzFcr0bawf4GKSODyaLXUNWbV+d+Xtw9F1QoYWWaGJmRMct15l4aY+6GSrM07YVaNdpg8DVsUTdn0//5xWpMvzVMLSEYFqOvgzLBRcFzpsnurjP/V3TpgbGI1SWfzU25TA9NyI2LVgNjwIoQxNLKa1wYNlMuYJUWv1qQUVJLNcJ8zioa8OLu18HlgLG3UZiZ597nmhxA4s2EGXpIBm1t0QsdwlRKdoyqb6JHG2fXtZbNHJJZXLAujg+qChVLcslFkVnGYldYYdA4vmDmkYcS88zslpQM/Y9283xqHUReY25jN0GNG83KaetutGKmHT9gcXPX4bfKqJi6XLoUzlWpp9cBE6WgXgMJ7PJABml7aRdbyebBee3onnOjuTjFQCDPq15mw5ur2yR/In0M2ft9ZPewyb+UM4JOAcXzhMoycgK/ptkSXrHxNGgXF+VegjFpjiumbUJlRt63ib/A2XwuKOQN8IrZW9Z7KO1TO0T7dUghldM4hdgPQn0qIoGsEx+G4EIL2nwO1GrJhGHyhlc2qbf7WcUtVjtHaP0aSAeZMLNgzM7h48VF4eIGmHITuLQKTCfNS6ntSk48qq9Hq7cMScWsUAB6RgljYVQ+/DNJurVADCN0OJM1wWtMAi1qK1ZJtSSW3UG8vxuo6GQAXzWlYAqd5LzNBXav6ZwKu1DIB775Rb5VVnX62m57sDsHXnvDrC3L+ftQ3o/Z155vO35ycw4lZM34Ffg2uwd9Yc+id/omlQj8aMlY/noZgVHcDuBOTCSSeQ0Zr6wYrtZhmgxqedIY3hiPyFgbapj9Cy2pqsYZ+YUqS/SQOD1tIFQpSB5yaiWREVmkYkVdUjAMudgTKxC7YhI0z1ltINvUhaHgLeSllxGpS0Y1MMlkSHAC5LTpCsCBAADugcvE5cls5UJBvuBmGNr2IA7M+Wzu8o2Guf2KHTtN959rZDqQ3GS3e06F27sME8DGI2/Q10xolwXUKhY0JScHegtnkE+pTwDbYPvTjWL3sP3JiI1mne0f2v/G6ozgBAZeOhQvYbaUpg5pwHj75LQ2wF1dhu9KhhB0R5fn19IEFykBhE1vD/mcphZERwF+O8fR9QGHG3j5Li0Ke67dhbwLFzIrxun2jae8ZLu5YvZ6HKN7CuupcN3mlPr70a2S27kqUJgHzybsTU21tjjdxfS4/gbJxuRye85duxI3xTp2fRr9FO0SFW6LRxG56jQash09NYLYI+jTM9t7HV92O6SbPAffG5SDmVJeNoqlzDcZczUjvsnpS4dcyYg3OH0O/m+Xmv+JgUSHgrTDRtNRKOyfM1wFvZIQixQCRNqiS5Y4weQzpALJoim3Xj0CZ3E2pWvrKGCCd8wwkrejEXWwI2EOvFSh6sfgMa2W+rdywI9HDdVsU4/mrbHgphkyO0hhCRetf2P33pg8tqxKM0P2nISsmXlisZGu2srwqdGjmdivrGCNaAIum5zkGL0hi9dZPzo2GVftiYsWCKwcA6ai8MjtsSVWhDrrmrQTSWbgJGl2xRQ3m0oyqzx/Oy92Ntubczdf56ryYHQElV/mzhg7HN4XvnLXfsXAdScsB4tCAoP2FopI2b15pElTEyM7XDW5dyzHq+glI6ALuem4Y6+5FJprA9og2uF6Jq5wCWGOfHlrav+efLHEYxoBGdXO1uhCrznW+tFzuRAYg5ebckmWzFgy/S9SSKwaJ9VlMqSVCSzf1mTBkiCR78mpJv/n+4PDo3/wMYBpurrdpv+CCnRSXVpA4CSB9aG1YyUDYsAmzy/1IHXunLOaHPxA9l8eHz4/PtjHMNVXb94e7yMc5yxv7Fbjv5I9s7tmJQsU0xS+cZC5Dw/29we/WUhV+Qtm2ljxQxtZ16zwn+F/tcr/dLCf2f8ddEYotPnTYXaQHWaHujZ/Ojh8erjhISDkE12AbStUMpNTsOerQPpfXIRrwSoptFHUoPEGbbDcdDUDx8LxBnIUwUXBvjK0Lxcyv4hi9Auu7dYXyKWosK9PWGdELIfGCqzqwUOlIWUZEAt+7PEF2lPG8dbC3MdkSstE8G7B8L/1Dsuc6vmdxLWWqtoY9KG/nfz51euNd+wd1XPyuGZqTmsNVb2gztWUixlTteLCPLGbqOjC7YGRFlUgF3WYDNloU8NF2aiud/8WISYDo3BRN+bCvyCokJrlUhR6M5S8diMmLNvylGikvhSM1A1aApAl/puJAqjyUlgWBswN1YM2MKzrZPDcPWeBvQMUAskdZ8Dg4r74yCu2cX7JrZSCcBLbBUQF7JJin480CaVN28Jtzh6XXk4O7FTZLxWjxZI8ZtkssyoUbUpDzpfa0lUYWD/BKy8ZTwLwtMT49QXXXTH3pBXtw9w4MzCRY0ItR5ACLJOnrx0MO28aJWu2d1Jpw1RBq50nqTZIJxPFrtBU6j85/7zzBKyvgrx7d1xV7e3Naenf2t1/dry/v/NkyLyPuuWGh6SIa0Ou3UqnA+PovTS1wcKt7uUhAbvdaCuUc224yJ1R+p+i31w1luiRn7gnrDi9Gy5X93LmK28CmBrLurWU4Jn4sEjlyut0gEEuVXKBAmhn0Ryr0Mal5JIxJ8uomphiSN/gMcppmZFxu84xOgviYpbht3RbvhpFc+NvoBjCUWfPArBhCdxXzU33xxUsyzHQta6tmCXBh2AvaLTBWH0InXQDm9PjUe0rA/DGTgo7QcsNu5D3CXINnfkqb4C7dOMt7gPeR/EKWi6FZeP6aoJlpzdglzc9YMiurz1ezrpkGcUgcmhu+JVVCCx+plxp44t/Di2K3ciEf9Ml2Zvo2gXBVPFywhJS8yfVpKTrV6O4vrzQHXa3jglOS0k3dK5+4vqSwNhYB5TLnrLmeLR2cjrRsgTLjn6SnrMvmmEFKizr9UgH5chd+fZ0rV3ehZCqusHG3WCdH8EUyX9nBcx3zZJHwdtVggC/b/nFwf7+ipKdFeUCo3CwDCfU2LIqaYUB9FSAC9CVO0P7ntZ81uH6LWAaKoPDMAuK5V80Y4Q6iyosA3Hq9FNalr6IW8cvPeWBZ3d80M5L/bZ9YRX+TmCUrqOTOKtI6oYCX7EmEyu2eXbn/K/2OcTBeG8imDYA6gzA8CWy/UVGtZY5b0sDg+roi+0lleEQYXvOXOJdn0C4I2LmUjNXKByN0DDZqRfNyQcpuJFwBfz729MP/+GLioMJzCV4Qz0+iPJAS643l/bTW+h0yvBCsK9312CimvLO3rOxI7WN6TatHrXqkAxLt8kWn1ELkHTp72V7ONs68mrGzMV9zfcZhgPwQaTQy6rk4lL35oXBk5CvO8waMwLYwTB6cpzhMIdkmFIuCKN6afFiGJDGZOmIy38eGTyCYlqLWQ+JsUn7DusA2MH3C5bMESm4gnPl0Pikh8aCJbUP7jD3axhpRe7oSvLhIg7NucP0p3ag1lLl43CQK4nwd8dLumA0UdjBPdGRlSnBEWB1oy+nr58gp3A3ZBQ09fgcfmyRRORCRCW8gh1xEefo3pVKYLRHYNlWSWpiyLK4H5ScKV5RtUSeBbj4sbPc/sxJ9sO9zR0n7w/OW92eFMPh3n9+tD8MzAdLn/Euc0FkbmjZMa/2wNL8903BSuw/wwlGfUqw41tg4D3LOJwRUVqBhRaFV0bGdo4x4alEAt7dcZ+xVEmG9nqwE+k6AfC9lXshwglQ5kIaQCSuZGHPT9GbOd/GzBUzFIO4wdVcdESomGR9QlL0aPPQPiTVKLSvYk66a8NQ4R3thERlmV7JrqjoheMmoU13DMG6H9vY6ohRXLevHQ5Meq8uqbFE/I1TtmMPIoDV2euo8r3b6nftk02rU/uqLIm07AoMk1xWdWMwrNCVN4HwbAipi7pjDFgX4/YYrbyJzTBEFCOY9sDAQhbi+hhCu1LAaRs0OKeqWFDFRuSKK9PQ0hcY0SPyGqoiRNUfUGn5qZkwJZgBc2fBbpN8bVc0TAR3dyG/c2PHVVO6hhYTVUP3ev7COyzHHrqx3crKLlkx0ygsVbVBIZZtrezjtauC/EdngYP1RGuJ1vAFcsRRm3T5LE3ZcWP/1tASOLTPLrej+ChbC4iLPmqDfqwsgvFB2p7jTv0olvMiNO9B1dZI+81Qsvc2o0jx7HZtbyc6EKV3wbmGClgbZgTqvvPCBd5t2TsXs2mT5ulzgXaSawvVHCdZFI13J46hHQFsW9ZHzn1nwgNX4LXP5f52CeTv3DFaM/O2G3kMHKO3UrkyQb5SmmsW4WwWSZ04Owx03BmH+k7jTuuOKbmqRr4ITZRiFtjqKLa+R0WJIrNLMmJLdNcQWgh0VPmcGwZVBW+NzNYz+/Xl84vnRxt6X3+umaKm7TuUADMUbhHLp+6Cbsc4hzGiN26WKW4P28/n3b5bw/G3sgN4vKuKNeCCP05GN7K+cDjtus4t+mqwGaWf7IYGV53Hvf48u8BeL+IOZOQ2CedeKksG30LGZm/f/cTkMTScypkwUo9IM2mEaUZkwUUhF12Lc1ugiaoFF1tMP23J+wPNLZH8684dFot3pQ/Jt+TkAjOzoSXYy3cbS/ggf6VX7O7rQFnR22RCbqBLnepURoqWRSveESruurCCTTgVN1nRuQPDkR103Szm1IwIjjWC/oETXcQkOLCYfobq3VdzsJ8dHGUHd9kgvxmggCi6INqotExklPdipfb7JbSj7Cjb3z04ONx1CQh3WQvCt8GSHiqJDOzuQyWRh0oiKawPlUQeKok8VBLpgPhQSeT+KonMjelYzd99/nzmnty2Ir4dIkTS3Ka6LDbFyypm5nJrpvB3xtR+KoJTDeSpoDMGjV0QHTdhcYCHkaSUC6Yg6GsqVSgOkpFzlp6EnffhxVe05saOADu2492jO6c+98GKVG9ene8QojEFfjBsf8bMiNSQFF43A9mRHo8TWSwz57nZFjY/OwskUFRAK8w8BDr2MV9IVQ5kd3u4oZmh2rDe/q3yzXD8Nk0OKNdPPwS3XZ0+3tublHKWuadZLqu9oVXoWgrNMm2oaXSXc1+3ks2rSDpCxtkIztZj3mEFR/tHa2D9W5CKA/x2tLKy7NA9Momg+A8Ad5AdbFKmMhzF4XKVm1LBqpKV67AtDS07LmYnKftT+tiiHrSBOaMFU6kJp13q0dMX1zCZb7+883ULW0lSL18OrsQfgj/WJrnzccddig/4H2abrjv6YZ9aFXmWiivvw4P14gk6rWiSci+j6ja3EFMAa30s3t2z8V7OWqnVx84P5bVjheqkLMAvJ58+jkdk/ObTJ/uf049vfx4PovbNp09byJRcnVIIQi847j4s7YJiM9PG2Wor0de5YDDkF3wAPrzZ4tCn+9FucDhcR9EbyXATNsVSDSU3GBNgSAOpGaGyRk1Vr7jaKfpxFQ1l2sjYDe/KcTuijD2+0GvYJyvUadQ/icnBjRRXLugULnALH/UW13Fuoct5Tq9YyGbSlq4wvCf39ebquuSsQE8ZE7nEGuCKCLZIFT4umIZeUFcoH+clowKSfVPQh+K0b5o/SbR0iZGPegmUVhIH17Y334MMf20OZcJuXPxyynI+Jg83jyzywdD9hui5rKpGOFxj6K28YsozLRc9otJwahc74vp5u59uFZzihw35G914aG8VvQWT3Hqc0IxfMXuvOG8fVP+TXm3SrdruETTErH4EaeEXPuXfzn19ijrfz+enEJhY4kFexHYHR2jkPV0ylRFeXx2N7P8/t/+vWT4iNa9GhJn8D6e3rlNb7ToGAkaooBdoQ9kWvRByevLxhJy5Pv3kI8xGHnulbrFYZBaMTKrZHiZ/QKW3Pd/Zfxfh6z/Ivs5NVXY8n4ScGyoKqgpAua/Y4r+Fg8s1oSWfCSwCgKftIzNvS7mwfK8znobn3tICOYbIIhqXcja0vsE9eD5A6IoKfYM2BzfrpQHVM3Q4hdFuu/R2oQ2jbTkXRn7C8WPrWzJkgJeU9nyQx01Rj4jJazwjuzyvajgc2ZM/3PFYez5MXg8EgNTYmWOLuu4JohoZKvrColkdtfqsHzXhRlHFy6VLk8KyPekOzbmYaRQZKp4r6dN0cMtpqWWb6Rm/rC+XNRsRnv+Wpi5Pac4mUl6OiFlwYzBWLeaa3jKquWmc4NIWdb1iouhA2KYOhbxclsvCChbO1RwSRlFA2CvsTXF6htH7OgXPEqOG6J8FVz5X+49nU1xHe5RXfdrzHGsrus6LcM35adCdQ9jXDCxEI1ICn/iV5nbjw6n3r//PQjAY3HsYLrhiWytl99oP7vUHL+8ZRadTnncQ+IlZcRRTY1uR+7hzFf0d4WIim94V9XdENmb4By4MU6lyiT9Y9jX4QyOgJMVADe6K1nVUxdkVlrVy8i70vSNVmy7oSvKOgiAMolbKWLBymD/rdpxHmoBj3SLtirPFUCXwYSg8eqUiNVO8Yoap1VB1OEgEYReqBBz7X4gbDInsfqphmcttVo/yplItqCpYcbGdoNSoR1NIsnZZadFPTlmvlfw6bAg6+OEwO8gOssOh0tKgPJnlxfbSJk6gLA6WXAbYQSeNOuacnmE9YHcFUCfP0bCuLgMlrRcvVf+yYL6gxEhZ7tKZkNrwnGgnTcadN1MqLuWia4V4z6gSmONMTXBfzLiZNxNwXNgthrr0ewGRu7zY1TXLB3fi0cHx/Oe/1x+P3v39hx+fffjL3sv5qfrXs9/yo3/759/3//RoE2v4Fpo2XWtcRcsjXB/g9QHcT6RViD1/HCiYM3Y9kOBrV8kx7pDln/vqOSMy9iKu+wlJmyuim2oQoU+fvxy4cu/SEepaXLjRb40N9/0APtpfBjASfrwWJ4dHqR2mE2Lrg4rTpxtm/ogwWj9ZvmY5p6XnqaOQLYpJE60w7LJ2QyPcghmWm5EfGV7HxPrrx9r1+py7RaIag17m9uItJXmjjaxCyg+OA52RIavDrauT4S/FlM+ggq2RRDXiBuvUcmrsRFGRU592NOWKLWhZ6pG92VWjES8GqWevVrAeGMSnqfi7KroGNRNaKj0iCzZJZo6Gh4iLUmpNhga1+Do5++DW7sxhfotjexgtyzXmMCcb4bAQxUHFcoSoxFXpsL/aFzLAPdbtpb8Gld2CAuSDs0b/1rAGhyRvPr+H3DMpgBT8FeHKDKVtKxyNhJo+UBCxYFAG3q0eGkFu1M6ly3++Xb/BXvT8N2wXGaikN/m3zG5bDUVPY703GAILxCmS1tIDYNyttc+63JIWjo6PvS2Rqjgtt2wZDGDgbC6Wqw/M1nKZ5mmb+LA9vojudeWDmXI5b5ZF+jvNWxzb0ZY101nfbZgMNvYqgRqPyNizYft3Xmj4T61dzfGvS/iLLEt8GZm5/VvLkIe9j37Yh+yhh+yhh+yhh+yhTRf2kD30kD30kD30kD30kD30kD10H0h8yB56yB56yB66bfaQVDMqnEPUfeg1tv4vmwfKxcP665gJxfM5og/sdqtarlU1FUt76SJiwsCxJt2Jb8vSlrNzVtZQ1pUqRcXMN3gxrqVQ1B2GCgxShPAz1z/ShYSGeePF3CbKeJsBdPEudcX4v2UtshhnWUpxncbXKywDm9PaXa0BfUvASivAkAVgUP/vaf8Duv8NKGhA479fKroHTX+lnn9vx2C9fn+T5W2i26/Q7O8B7L5Of3PYb6TPr9Tm77KYvh6/bhV30+HvM1Vsre5+k43YXMntae13gXqtvn4T+DfS1aMAMugk6KBE1n2WPLxNa/iVDDt0qM5WfElFe8tDyy4IuvEetaRTHMS/h47XvNhLOJEL+YnTGvBe8S05s5oXYyKnhgmiDV1qHzfmG1Njj3mrTEcxSbmsOZoUoAZmKSe0jNobepAjge0m98HGtfk2jys4C/hJubrrfqfn31aw8eD0TJOYMwWtN4gVhxmUiJspWjk5XRHNK17S4TCqwYXUgwi9h8Rev4qaQm1BPtR3gqrZTTL5boVFqmZN1emtZ/98oEur5KBsjORaK2lYbsCtzw2/YsOexQil/76j9XxnRHZ2S/v/VtCx//Vd357v/Ed/0ewryxvojLStpZ9MoIMGw2Qcdw49E2inH1zRXqPV3oSLvUFqAe637R2DSQYCY+0K4LcR5njhQTC++Q7VYY0Yg/uKCgzTjjsWpR6sqPAhoWSi5EKDH9WnyjlgPA4XbEJq6OjjO29a0VoM9lSBxoJFdpfT1aa9Hx5t7COEdkqnr++/EU97Dx/uHzzf3X+2e/j08/7L4/1nx0+PspfPnv7bhtfxZ9eaKSFL155nAOyFVJdczC4wtmuwc/ptpIm9uazYHi3j/gXXgu1gIQEWb3kNV3YiOjjreio6fEoebio6tF3hGDbg9oW9pzTnJTdWBKj5lQTCpUo2orA3P2fYQQHbCfvhwIcOv+lufxWXSaAZg8bfFRVLqxLlLITjkM/xpGFMbPgIPn5UhKsRgRy/EIiNh4g7CUDXUoAU79ImW9F27NCWRd73E+i5q5hhcevSNiiG6VGUkDphpBEFU6CKhsAnNXIBsKM4+nVE8pJDRx7/khVnfNRfHGGckVNsvOOWRcsSQmeNbEHm9XiEghkFSUk4vABSqEtPOT0jRvErTstyOSJCkooaAxmTEAlhYAKqoHnmMsT3x5Mc02yS5Vkxvk199oHQpJUHaNPwpJMy5HtblAD5SF8cNkr+jgJjehGR57eIh3QfDaSlOgqDOrZRXHsuhXAJBcD8MSJNsRlVBYb0aei8MorexLSYCQ/RpVaexWS2XKpCY9e8z6/OQqsg7EvsIUNwcsbtvx2WuODQnvD8Lx9dROtjHfpa2KHa6XF4rMkb8u+6c7ji7+Wyv/hO1oTQvvU7sAEXikhobhpvYsUOcExVZCeMtINdBKYursfPLDrAal+BG352Kou3Bw+k7/qqvDkyLt0ZPIbddbc9T4am0GYdIW+DIzkEjv7aiLzVg/CYu++GhmlRKKSJBrN0glu0iwb1Xq/mVzj0ngc8bcmBKhstLO+uqDA89/kT3u36FdtCjNrW3lbBmzalfeGK2+Xx31lkBRYkZwr0xzZZzLMnFUaf0rLUoSVkTg2bSbVE/uQyrLXhZUmYgCbV8NqKHAGLoCkHnYPWtZK14tBO+hYMyLHsbYmRGCCGPf9wO8Idgen3nk9UEz5rZKPLJdKsa4/IO+EsOuhcEJIGHu8Rob4sPfD1BgraS0sjGSF/afGLNdzT8Yx0OX2KLtokEqT1ceYejL1TvSuDCHtBtPnxRYNBuqjBjO0FZEEaZwje2N519raCggeuRUMyJDSFtSLFkPl8+1GsPno0ee0V3uEdrwQ5Pbs6sg9Oz66et5s6APcNEoFvoNBKZVZC/e1Dj1eCgBu/DSgcy8QJsr9RrkybVfXyaDOw/wzJM9D7pk2IdTGlqNfh1TBESHfJZGkh3VB5O3OZLbcC9SGc6CGcqL+qh3Cih3CiTZH4EE70EE70EE5023AiV4qjb9JoH24e2OHrenT1ZxP/JhUE99h7s+28hjFGNPbGlSVEbqwKFJpyUbiict6XCMV50GLl7/jIzofT2y86eU93bBJ4bx22oqAcX6yxEQKtOwD8YJftwmtV2HCrDF1Wl0iF/lt8vaKXTFvFqZZa89SZQ6ByXIrNKDEWd05ExRyHwQo9urzZUTEIw1GciRz8E1o3TKN1w46nWGEX4pr+gZ6fDGjFOBcL5jtp88K3/g4ZmaJo9x8tAlzMoOGoayb43ZCMWzx9wZ6xyZTtU/Y8P/rhxWExYT9M9w9eHNGD509fTCYvD49eTAdKN90pU7F1SrCSasNzNLfuutVs6JGIhR5P323imjs/K3LXYp4WPoZsNtfgD7r4guE31Mwq5UIDd1vIZDiP4lbJg0Z3/sSplpB9q0v7u2sGlhIgcmWR+L4waNB1yxt7ohPY5i35/KTE2oQOVEsKBddG8Uljh/ClkJA+VAO23qCmz6U2mph0ae1xQPukt9P5BWOJEbesAc+3qzgHxWzklLyJdztGPSzHJZ37GAvUmxptOolq6CZ8KxX5M6NG94fh2mKrYFPalAZqXdTB4xPwZ0lznIzrPBpTIiTx44RuhffdZG7FCbiJLy7K3bwx9cPH3ufiCgpgN9aBKyVhgvbekh2y9dPbUddwQxisk0WeQpoSyKizW6HmVjLDOEHgeNiDaraSQvvKdWCECTp7cZNgsBvTzNPsMNu0ld6/+FC7lFRiqeM6emm5H5SxkpdWtKQuMpkZbBqdCh5thN+U0CFiGcAPq+esYoqWW6yq88bP0RM3WlmBPOZTuJnZV65NJzevlTvaXrDgBtCE5kpqTRQDr7irOBdImBdjUkjofjtc5/8lPZo+29+fdgRUMOx35NP42WbiKX6yiWcntO+nzo62l9Rh7Q61uScn9ks4d87NJdBv6IVwHpUHL8Qf1wuBpYH+p3khulD/DbwQq0DYohcCj9P/Ci8ELsWZ9uNSVH9QV8QN4H3wRzz4I/qrevBHPPgjNkXigz/iwR/x4I+4iT8i0fcaVabK3pdP79erdl8+vfc3bK3kFS8Y1netS2aY/RUTB4nOreo7ctG1UDmWmvktdLDVHXvuK0kX+8Cwom2l0yiobOsDnM08VdM6G/RRGhcXx8VABchRXPCsAARWmFdCsXONRVoyIMT4UtC0aA6R76WcOWqzn3Pt8q1+bbRpAwl9kU9EdN+KEHrPhLjw8GkYmoK/YkF1AHgUdrcrFa0yLaT4jXtPOONZlsvjo6One2hE+8ff/pQY1b43srbDr/h5Cymo69TAadgj1Ml5ZVU2hz+IpGw0mpxHyFZahTek0ScjjhtVZnbM8chuNETsmmR7FMul0EY1YCOTivhNQlJMT3hClgObcSv0D1g14ThvzRACo3ea241Ci4IdWMTOwLE7xlTE47FvqVTTSPWFUVdjZXOF9H5W+dqZYVatMt2i7nJPBWY0WVKzp9zzERduLZ0e4uq2QgMBjEUvl20ud2ocdXYhdHGA8wT6XzhSTiqbA03PZOjz5Ww2fbUnoDhdzaaWj9VJBsKwWeKb2dAA0sPz0dHT4b6hR0+HNGoz3xY9nEEbrFXU4I7nzoDaDNke24LKHiiYwDGkIMgAnPgL5kB3YU+GCevosJcuWcP5/Uc4v+wr1F2OGgLEs0HoOpK9bwOXDCSkHQcoN5QKjdYBn4ffKMw5aUx4K4XedJCAtvm2V1hVmxYuWAK+kfr4cISO4yvxtJIJMwvmugaYhcTTPVSbQNFZtcWWtfbERH4bEICmxuVxjL8fR4RpZD24id8PMmEP+MCaGs3UNnOkv7jxO3Q6aDfTujPuPZ90HH8YkhgfHWlc3zDXyW4ExBJ0XS/DNV/gVZRcob85u6IRiRlJWtE3831GQy9F8FmBVhtbvu0TzjDRpL1tYKI51dinwcypQGt+MWq1CAHliJZekgZeAK5AIqctTPMNK9MY1VxXmAbDpJNHkbkyed4rVzNQ0ib1nf2tw5x+7ngkmm7YUzDP270ZOBP3E3JDywlL7vl1UuDcXtu+SkEpZ62wtAJGK0Z3bUx3SPc9AWDJG2jVlsiB13CZRxq1BFd8ZkroFeUl5s/3gGYV5dvTZu1Bgxm87DYAwZzqrQk1LrzOH/h5GuYWsyF04cOLUGlMimUF3avsK50L5otm06a0mB0DKUDJEeX+AcFJIZAHmkEAldMyZXudjk05FfayclfzkHeiY7v3/onO45sX6MbYl8ilPaCQwzsueAqCuhx3dhJ4Xwm8le9hBRdaTxXrKOOa1ZO1VdEQLz5sDZI+93yprWwY7J7FcYuAx24GAHXg/k5LmLW3OImf3+wuxyE9ubRxIFYZdNV5fFEKL1fYb5doIwrD6blcuK7OCzYJ0ScQJhUV3sdKBVRZabUJgIeqRzES/yDmOwfsVRp51GJuUNnb+SB/52VJ955l++QxP5tLwf6BvDr7QvDv5OdzcnB4cYDtGn1BtSfkpK5L9gub/MTN3vP9Z9lBdvCMPP7p3ecP70f47o8sv5RPfCDU3sFhtk8+yAkv2d7BszcHRy/JOZ1Sxfee70N1rQ0v3tvcZzjRZniMibvd9xu0yrif7fyX/i52IUk81dn+gBWHhejM+8EjksTN8egAGTgUDy0gHlpARFh7aAHx0ALioQXEyg36/64FxPehRabVUOIWZ9+Tzz+//vl4qM+lM7PusVzvYdbP3sGLl4mEijdpp/XXEApWrKnb2MvdzN/t2s+PyYRRy7bdhfZn/NfAUK+c/Rb6gkoB3wV1yGvOoBSWrpCKa+z0XdrPLcTuMWoywyv2e3tN46poyUOaW03N/NjpSp2XKz5TFCEEu1EyOs6YDCsnv7Lc31D4j4sboDGsH8Qb370QFu1DlRMImFKhSVr/LlwxyRv7UUcKgPI5RcFdfSIrE0DwtEuYgXlCnPSqznmdTJTbhMUDaFH+RrKRPdLsb6Kl4Pi9tfsHgw7SfH/gwQPSHd1Re17KpmjJ/ZX9p7dmQtoJLaihwyfgg/sVVa48+VTbLWpzsGhRXMALF35IX0hOqvhAJGuGD7JaSUuabX3BwNPcL7tf19NQLMy6Tyy9/CjlrGS44sCxTiwyMW2xLOJDEwKOmaFZAAyWes1uDL68dq+jOXzaWJvesX6akLoY3r/xTBsQWGeuTWk4ms1l8l1Ex3D9ZO6DLPpg07kcM+YlN8uLDZjr+q82ndVR2qYb16PyTefBuLqN5kheXcEPCplfApU6hvDa/3vgcOFvkMrVzYdyv9mjredSmQu8H1p1i4p8LpWfbzcwgxWXYwCLrDXc+CMfR+9SLsDW2uP2MZoiVA1/MrgdK6aq6Kx/t1w7m/2qq+7fYNbOl5tNevvpSjphpW5FuXdyQYwkFa0tn9XsH3uwJOIGWS9ykGvimSyuCIKQecp1erij23f4r4FBTq28EFGrM9vaz32CcRYRqH0+RJ7kP//bz3zZTKw8jHkTbv6f4mcDULS/h0s2vTHbQUk8+/rT1H507YlKgL7ZqaplMUxuN9rECAO1LNA4MDhVM3B2bzvTmSzIl9PXw/ZKXdP8/hbVjtifTBa9o37Hybx6358Mj8n1x3Gzidy5r+hAeB24orBE431NFw05POc1DPC2+AzDrkDqddz+7vPiuI7DtJ0Zel0ZBsb15cUDYwly7BAj6HR92JgLsK+b3je+ZPRgPfgVckgpZ+1q38sZmfIS82LQqrpOIS/96yUXqb6dLLyUs8y+lkXhcUO7p9hvDVesSG3Fa/xdMHenWo0FBSKSoVZ6HMrs48BQTxoqaA9AhhnetpXcj8l474qqvVLO9pzpu5SzcdZfp4utTVOB77zY8yTft7dkOfM5vm7dUDfWpdkNACmnU83SzklRdt/ttgHHdPFKtVQGGm4LhmXYNaG9es1GMVrdF4Ys5eKIZDFnArDAxSw65xgU78LrHmlTyMY8IlLB35lSj1LwuKgbE2tBLThRsNAarMAAWMyis1/tXmF9YFdJKQ7qBlQiUUKp87bYR5jDy1NjrD8hMa3F5R/g5NqVpXY6+VteMjCeoVTjyD3dlKWG04rF2Jf3RyJuQMK+GkVb7QVNBVwqbpbDoPhf7w0UP2CI+4Z5hkuKIwiaXTH7xQXcyffJwOZNRZFWwZznJ1q/KVsHw0803LUocw1i7hMAkVqO7PADbGta0tDc5fquBgm7h0/9DENbPTemzrAyuWaZu/4uSiZmnStrwLyYfDqRxTKLc7vX2hdu0McO/zXgEx7yd66SJYZC4NIdTMCzHEKzASPrRobrzzHPcUNhiFLge5hEMLQhfupKFk25mZk+eXUt2i2pX0DtC0OreqPBc8WiHhvd0f9fAAAA//+aXezd" + return "eJzsfftz3Dhy8O/7V6C0VZ/tZEQ9LD9WqfsSne1dq9b2KpadzSWX0mBIzAxWJEADoMazSf73r9ANgADJGY0e49vkk6/q1uaQQKPRaPS7d8klWx4TluvvCDHclOyYvHl1/h0hBdO54rXhUhyT//sdIcT+QKaclYXOviPub8ffwU+7RNCKHZOdfzK8YtrQqt6BHwgxy5odk4Ia5h6U7IqVxySXyj9R7EvDFSuOiVGNf8i+0qq28Owc7h88391/tnv49NP+y+P9Z8dPj7KXz57+m59hAFT75zU1bM+CQxZzJoiZM8KumDBEKj7jghpWZN+Ft3+UipRyhq9oYuZcE67hq2LVQAuqyYwJpuxYI0JFEYYT0uDbHF9TjMazfXQrRiySqVSElqWbPEtxauhMr0QdYveSLRdSFT3M/ftfd2oliya3uPnrzoj8dYeJq8O/7vzHNbh7x7UhcuoH1qTRrCBGWmAIo/kcQe1AWtIJK6+DVU5+Y7npgvqfTFwdkxbYEaF1XfKcImRTKXcnVP33eqh/Zsu9K1o2jNSUKx3h+xUVZMLCKmhRkIoZSriYSlXBJPa5wz85n8umLGATcykM5YIIpg1r9xdXoTNyUpYE5tSEKka0kXZbqfaoi4B44xc7LmR+ydTYUgwZX77UY4e6Dj4rpjWdrT43iFDDvvbQufOWlaUkv0pVFtdsdY/wmZ/XEafDAP5k33Q/Rys7FUSaOVMWwSSnmg2Ok+5BLkVODRMtYyCk4NMpU/ZoOZQu5jyfA2KNPUxTxVi5JJpRlc/ppGQZOZ2SqikNr8t2GDevJuwr12Zkv1366XNZTbhgBeHCSCIF6yzH457OmPBodYzxJHo0U7Kpj8nhetx+mjMcyHHLQE2OrVBCJ7Ix8E8tp2ZhV8qE4WY5InxKqFha6Kklw7K0BDciBTP4F6mInGimruxCcfOkIJTMpV2zVMTQS6ZJxahuFKvSFzJPjZpwkZdNwcifGQWCnsGbFV0SWmpJVCPsZ24qpTO4B2BV2d/5dem5ZV8TRmpZN6Vlh2TBzdwCS3mpLSsxAReqEYKLmR3VPrTgRItRlm/ihjs2O6d1zeyW2TUBWYUVAW+16xSZQ/pUSiOkYfE2+KUeW0K1I1gStTDBkoH7lnKmRy2MmSUCy/+nvGQTRk0G5+Tk7P3IcnS8GML46bLc9tK63rML4jnLIkKIOU4hmUYmM6dixgiftifBEgfXRNtvzFzJZjYnXxrW2Bn0UhtWaVLyS0Z+ptNLOiIfWcGRKGolc6Z19GIYVTf2NGnyTs60oXpOcE3kHBCfJWwFKNwjNb7r41NiCYJLEZ4PcSmy4ppac27sn3/BoRPSiVhOxOyeZ/vZ/q7KD/vw2f/fBnAfLHmshMwefBQfKEDgjjAyoBm/YnDZUOE+xbfdz3NW1tOmjGkByVr5BROzkORHR5eEC22oyN310zla2k5uz1cy1qQxlgs0FRUgl1hGSjSrqUKy5JoIxgp74ITjwL3pkgE9seayspNPlaw6+DidEiGJP1SAAjxt/pGcGiZIyaaGsKo2y2xoo6dS9rfY7t42tvjTsr5mi/2RtoMTbehSE1ou7H8C7u0Fr1GYCFs/WUa80N6GWYoqEdhTwHr7/gLGctNMWPsK8Go+tcSRDLeaUBIiqWg+54INo90N0cc9L7aB+c+Cf2kY4YW9CaecKdwGe5wAB4/5FC5uuN31k86+BCnLMmxk8PDtwu8CsHNeDC71JT2aPtvfL/pLZfWcVUzR8mJo0eyrYaJgxd0W/sbPcdu1I9uxgquqaFku3cWiCc2V1FYL0YYqKzxYHjBGsubFONxE65Ay/S6VkPKS90SkV/GzzWSkEzeQ5QIFm4JsRvEIccENp0YCEigRzCykurRClGCgJSBbRNlHsRlVBdx69vaTQo+iN/FqnPCCK3xASzIt5YIollsFB+/3T6/O3HDInVrIeuDYB/b1CBjg8pqJAl8//8sHUtP8kpnH+gmOj0JyraSRuSx7k6AuafetM50CFZlZ5cKLFx4ZRlGhKQCQkXNZsSAdWFncvmmYqsiOV3ql2rGXj2JTppLpRWc5GqUW97OT83APJywIdpH8CtMSC4qY+R1sB49hRt3REYsf2nKlRjew/FaK5MKC9FsjEMUgVDox0ZkiyMA4LSKtdNWOZskFt2QXDm6qcNs/bqw9P4litWJWCIOrEW9pqz1qVlFheA4SPftq3IXOvuKJG7l7k+twoRtJrrhdH/+dtfK/XR9ToBNobhrqMH86JUvZqDD6lJalRjSCJGHYTKrlyL7k7xdteFkSJqxo7EhRNirHO6hg2tjdtzi0CJrysrTnrK6VrBWnhpXLW4h/tCgU03pb/BDIGXUAR0huQneJBXZRTfiskY0ul0i0zjzDyzIZT8uKgX2KlFwbu1+nZyNCSSEruwFSEUoawb8SbfVzkxHylxa/eOem41llH/ZS0YWHzRP7OHMPxoi/vvgAxqFWOigaNHigejzOeD22II0zBG9sVb+aicLJd0BgyZD2XgDlJBu4qesNb+rkxTV7c3oWFuy4IW5RZ5nO8GJBkypo6uT07OrIPjg9u3rebuoA3LVUZkPISylmm8F+JpVZCXUwvtB8G8LN+5NX1yLOg4Abvw0oHJvDCaKZvyfvmVE81z1YJkvDBg76JjuBCm9/iCBgHLw82gzsP9sRUCe2SkZ8xRiJt5DTZPuEBGz/litoIT3ckMJwttuBOmOxCO8kq5+Shx3R6hpofmIyGKCoVS+UWsbmJ0p0zXI+5TkpJZpciWKlZ0X2XrtqxTr8I5WFMzVnMMWv7C1r1wvM1XO+Lnrjy4UMXTCRTdkBlEw+vHVhdCYvask7AK/BDyHvpJhx0xR4W5bUwD9SxSwQwaP/JDulFDvHZPfF0+z5wdHLp/sjslNSs3NMjp5lz/af/XDwkvz3o6H12BudCybMRcc2cd2q+uf7mjXFNoow64olfZDKzMlJxRTP6TDYjTBquXWgX+E8MOsKWF9RQYtBIBWbcSm2DuNHmGYdiP/csAnLB/HIzTdAIjdrMfheCqMYLddtNNfyIpfFN9ns0/NfiJ1r1YafrNnsbwGn2/Brwdz951dDkK7a7gEh+dYgftZM7Xp5OHoTNWfPREfEGZNQ+5FTMlNUNCVVlmKcm0QxvBY6khxsF0qqwXCH3IUrvExyJgxTTqudllIqIppqwhT4MsCI4fVH3RkaQSxJPV9qbv/inSC5J2XdA+eDBNObfb1coluJC0IbIyu4uWZM+nWv2LGJ1EaK3SLvGjZkU3TtGu2jzcwaP+J9G12jKAHIBvwYXEwV1UY1uWliZ0eLGLsPiUEVH1/j35g6AQ5Nfjo2CFNB3rw6RHeLveWmzORzpnHv4M7m0fToRWphthd96gpM/FdcBxNiCkQYUDXC+Z8Uq6QJJkciG6N5waK5hqGjxLlT4iFjjwt87Kgv9VzisO1Q4EVy08eOHDdBirjr9WL/eZA1lbziBVMb6cWBGll+eDehPrnwYcUekODti13VLD8ckVnORkSqlNHwGTe0lDmjYkA8pVeUl3TCS3uV/S7FgPV93TIbvcuoNrsH+d1WexKBQX4H3dd7K4Acgc7bjRxYCN4gG0G/Cr7+qjYD3t0oN4XY2/CzO9qgA9h89+Dw6dGz5y9e/rBPJ3nBpvsbqv8OEnL62pMcgB/8CKthH/bJ3Y/FKIAVXU/XAeZ/GXYk3Qar5jCrWMGbakOTgOdEkcfpGphpDnLavdHB8+fPX7x48fLlyx9++GEzoD+13BphARe+mlHBf3duxCLEejh3xrIN8EgvZHvZcwhFIBSNRLuGCSoMYeKKKymqvmWpvfROfj0PQPBiRH6SclYyvLPJLx9/IqcFRktgiAp4l5KhWm9LJwjEXSCBk3tpoPN4M4kgfJVavJ1ZuheOFFnWvXLeBYegnde5J5y5V07jYcAeqpmfcs7K2orFKJbgjTihOiKWMIf2evzSMiTDW23iBgZi9+W2jvtHHJ5UVNCZva2Bj4YlDHqzMPbqG/syA0iEF0O8saKz7TLGWDaA2YJZAMFaUE0mDS8NCDwrADR0ti342sPhoKND9982MdRCgJpzb/IkunGT6ZNIRxKCBi9uc68BUgaDBCPXTsqlXvd+2IxPRd9t4PaLPUuga6Khdc/Fh64Z9AYOP+Rsbewx+aO6qRI/24Ov6g/rq4r26X+aw2oY9G/vtVoPx/ZcVzEn+d/gv4pZhvcMAb/7gzqxbgLvgyfrwZPVX9WDJ+vBk7UpEh88WQ+erAdP1m09WSwIQkluJ9lYF3zPDN2Nb8ZwvRppB/sbpIwMJoteQ1VvXp37eXH3XFChhJVpYmRGxizXmXtpjLkbKs3StBdq1WiDwdewRd2cTf/nV6sxfWmYWkIwLEZfB2WCi4LnTJPdXWf+r+jSA2MRq0s+m5tymR6akBsXrQbGgBUhiKWV17gwbKZcwCotfrMgo6SWaoT5nFU04MXdr4PLAWNvozAzz73PNTmAxJsJM/SQDNraohc6hKmU7BhV30SPNs6uay2bOSSzuGBdHB9UFSqW5JKLIrOMxa6wwqBxfMHMIw8l5pnZLSkZ+h/t5vnUOoi8xtzGboIaN5qV09bdaMVMO37A4uauw2+VUTF1uXQpnKtST68DJkpBvQYS2OWBDNL20i62ks2D89rRPedGc3GKgUCeV73MhjdXt0n+RPoYsvf7yO5hk38pZwSdAornCZVl5AR+TbMlvGLjadAuLsq9BGPSHFdM24TKjLxrE3+Bs/lcUMgb4BWzt6z3UNqndoj265BCKqdxCrEfhPpURAJZJz4MwYUWtPkcqNWSCcPkDa9sUm/3s4pbrHaO0Po1kA4yYWbBmJ3Dx4uLwsUNMOUmcGkVmE6al1LblZx4VF+PVm8ZkopZoQD0jBLGwqh8+GeSdGuBGEbocCZrgteYBFrUVqySakksu4N4fzdQ0ckAvmpKwRQ6yXmbC+xe0zkVdqGQD3zzi3yrrOr0td32YHcOvPaGWVuW8/ehvB+zrz3fdvzk5hxKyJrxK/Btdg/6wp5F7/RNKhH40ZKx/PUyAqO4HcCdmEgk8xoyXlkxXK3DNBnU8qQxvDEekbE21DD7F1pSVY0z8itVlughcXraQKhSkDzk1EoiI7JIxYq6pGAYcrEnViB2xSRonrPaQLapC0PBW8hLLyNSl4xqYJLJkOAEyGnTFYADAQDcA5eJy5PZyoWCfMHNMLTtQRyY89nc5RsNc/sVO3aa7j/XyHQguclu95wKt3cZJoCNR96gr5nQLguoVSxoSk4O9BbOIJ9SnwC2wfanG8XuYfuTERvNOts/tP+N1RnBCQy8dChewmwpTR3SgPH2yWltgLu6DN+VDCHoji7Pr6UJLlICCJveHvI5TS2IjgL8do6j6wMON/DyXVoU9ly7C3kXLmRWjNPtG095yXZzxez1OEb3FNZT4brNKfX3o1slt3NVoDAPnk3Ym5pqbXG6i+lx/Q2Sjcnl9py7diVuinXs+jT6KdolKtwWjyJy1Wk0ZDt6agSxR9CnZ7b3Or7sdkg3eQ6+NygHM6W8bBRLmW8y5mpGfJPTlw65khFvcPoc/N8uNf8jA4kOBWmHjaajUNg/Z7gKeiUhFikEiLRFlyxxgslnSAWSRVNuvXoEzuJsStfWUcAE75hhJG9HI+pgR8IceKlC1Y/BY1ot9ZdywI9HDdVsU4/mrbHgphkyO0hhCRetf2P33pg8tqxKM0P2nISsmXlisZGu2srwqdGjmdivrGCNaAIum5zkGL0hi9dZPzo2GVftiYsWCKwcA6ai8MjtsSVWhDrrmrQTSWbgJGl2xRQ3m0oyqzx/Oy92Ntubczdf56ryYHQElV/nzhg7HN4XvnLXfsXAdScsB4tCAoP2FopI2b15pElTEyM7XDW5dyzHq+glI6ALuem4Y6+5FJprA9og2uF6Jq5wCWGOfHlrav+efLbEYxoBGdXO1uhCrznW+tFzuRAYg5ebckmWzFgy/S9SSKwaJ9VlMqSVCSzf1mTBkiCR78mpJv/n+4PDo3/wMYBpurrdpv+CCnRSXVpA4CSB9aG1YyUDYsAmzy/1IHXunLOaHPxA9l8eHz4/PtjHMNVXb3483kc4zlne2K3GfyV7ZnfNShYopil84yBzHx7s7w9+s5Cq8hfMtLHihzayrlnhP8P/apX/6WA/s/876IxQaPOnw+wgO8wOdW3+dHD49HDDQ0DIR7oA21aoZCanYM9XgfQ/uwjXglVSaKOoQeMN2mC56WoGjoXjDeQogouCfWVoXy5kfhHF6Bdc260vkEtRYV+fsM6IWA6NFVjVg4dKQ8oyIBb82OMLtKeM462FuY/JlJaJ4N2C4X/rHZY51fM7iWstVbUx6EN/O/nzq9cb79hbqufkcc3UnNYaqnpBnaspFzOmasWFeWI3UdGF2wMjLapALuowGbLRpoaLslFd7/4tQkwGRuGibsyFf0FQITXLpSj0Zih57UZMWLblKdFIfSkYqRu0BCBL/DcTBVDlpbAsDJgbqgdtYFjXyeC5e84CewcoBJI7zoDBxX3xkVds4/ySWykF4SS2C4gK2CXFPh9pEkqbtoXbnD0uvZwc2KmyXypGiyV5zLJZZlUo2pSGnC+1paswsH6CV14yngTgaYnx6wuuu2LuSSvah7lxZmAix4RajiAFWCZPXzsYdt40StZs76TShqmCVjtPUm2QTiaKXaGp1H9y/mnnCVhfBXn79riq2tub09K/tbv/7Hh/f+fJkHkfdcsND0kR14Zcu5VOB8bRe2lqg4Vb3ctDAna70VYo59pwkTuj9D9Fv7lqLNEjP3FPWHF6N1yu7uXMV94EMDWWdWspwTPxYZHKldfpAINcquQCBdDOojlWoY1LySVjTpZRNTHFkL7BY5TTMiPjdp1jdBbExSzDb+m2fDWK5sbfQDGEo86eBWDDErivmpvujytYlmOga11bMUuCD8Fe0GiDsfoQOukGNqfHo9pXBuCNnRR2gpYbdiHvE+QaOvNV3gB36cZb3Ae8j+IVtFwKy8b11QTLTm/ALm96wJBdX3u8nHXJMopB5NDc8CurEFj8TLnSxhf/HFoUu5EJ/6ZLsjfRtQuCqeLlhCWk5k+qSUnXr0ZxfXmhO+xuHROclpJu6Fz9yPUlgbGxDiiXPWXN8Wjt5HSiZQmWHf0kPWefNcMKVFjW65EOypG78u3pWru8CyFVdYONu8E6P4Apkv/OCpjvmiWPgrerBAF+3/KLg/39FSU7K8oFRuFgGU6osWVV0goD6KkAF6Ard4b2Pa35rMP1W8A0VAaHYRYUy79oxgh1FlVYBuLU6ae0LH0Rt45fesoDz+74oJ2X+sf2hVX4O4FRuo5O4qwiqRsKfMWaTKzY5tmd87/a5xAH472JYNoAqDMAw5fI9hcZ1VrmvC0NDKqjL7aXVIZDhO05c4l3fQLhjoiZS81coXA0QsNkp140J++l4EbCFfDvP56+/w9fVBxMYC7BG+rxQZQHWnK9ubSf3kKnU4YXgn29uwYT1ZR39p6NHaltTLdp9ahVh2RYuk22+IxagKRLfy/bw9nWkVczZi7ua75PMByADyKFXlYlF5e6Ny8MnoR83WHWmBHADobRk+MMhzkkw5RyQRjVS4sXw4A0JktHXP7zyOARFNNazHpIjE3ad1gHwA6+X7BkjkjBFZwrh8YnPTQWLKl9cIe5X8NIK3JHV5IPF3Fozh2mP7UDtZYqH4eDXEmEvzte0gWjicIO7omOrEwJjgCrG30+ff0EOYW7IaOgqcfn8GOLJCIXIirhFeyIizhH965UAqM9Asu2SlITQ5bF/aDkTPGKqiXyLMDFT53l9mdOsh/ube44eX9w3ur2pBgO9/7zo/1hYN5b+ox3mQsic0PLjnm1B5bmv28KVmL/GU4w6lOCHd8CA+9ZxuGMiNIKLLQovDIytnOMCU8lEvDujvuMpUoytNeDnUjXCYDvrNwLEU6AMhfSACJxJQt7forezPk2Zq6YoRjEDa7moiNCxSTrE5KiR5uH9iGpRqF9FXPSXRuGCu9oJyQqy/RKdkVFLxw3CW26YwjW/djGVkeM4rp97XBg0nt1SY0l4m+csh17EAGszl5Hle/dVr9tn2xandpXZUmkZVdgmOSyqhuDYYWuvAmEZ0NIXdQdY8C6GLfHaOVNbIYhohjBtAcGFrIQ18cQ2pUCTtugwTlVxYIqNiJXXJmGlr7AiB6R11AVIar+gErLz82EKcEMmDsLdpvka7uiYSK4uwv5rRs7rprSNbSYqBq61/MX3mE59tCN7VZWdsmKmUZhqaoNCrFsa2Ufrl0V5D86CxysJ1pLtIbPkCOO2qTLZ2nKjhv7S0NL4NA+u9yO4qNsLSAu+qgN+rGyCMYHaXuOO/WjWM6L0LwHVVsj7TdDyd7bjCLFs9u1vZ3oQJTeBecaKmBtmBGo+84LF3i3Ze9czKZNmqfPBdpJri1Uc5xkUTTenTiGdgSwbVkfOfedCQ9cgdc+l/vbJZC/dcdozczbbuQxcIx+lMqVCfKV0lyzCGezSOrE2WGg48441Hcad1p3TMlVNfJFaKIUs8BWR7H1PSpKFJldkhFboruG0EKgo8rn3DCoKnhrZLae2a8vn188P9rQ+/pLzRQ1bd+hBJihcItYPnUXdDvGOYwRvXGzTHF72H457/bdGo6/lR3A411VrAEX/HEyupH1hcNp13Vu0VeDzSj9ZDc0uOo87vXn2QX2ehF3ICO3STj3Ulky+BYyNnv77icmj6HhVM6EkXpEmkkjTDMiCy4KuehanNsCTVQtuNhi+mlL3u9pbonkX3fusFi8K31IviUnF5iZDS3BXr7bWMJ7+Ru9YndfB8qK3iYTcgNd6lSnMlK0LFrxjlBx14UVbMKpuMmKzh0Yjuyg62Yxp2ZEcKwR9A+c6CImwYHF9DNU776ag/3s4Cg7uMsG+c0ABUTRBdFGpWUio7wXK7XfL6EdZUfZ/u7BweGuS0C4y1oQvg2W9FBJZGB3HyqJPFQSSWF9qCTyUEnkoZJIB8SHSiL3V0lkbkzHav7206cz9+S2FfHtECGS5jbVZbEpXlYxM5dbM4W/Nab2UxGcaiBPBZ0xaOyC6LgJiwM8jCSlXDAFQV9TqUJxkIycs/Qk7LwLL76iNTd2BNixHe8e3Tn1uQ9WpHrz6nyHEI0p8INh+zNmRqSGpPC6GciO9HicyGKZOc/NtrD5yVkggaICWmHmIdCxj/lCqnIgu9vDDc0M1Yb19m+Vb4bjt2lyQLl++iG47er08d7epJSzzD3NclntDa1C11JolmlDTaO7nPu6lWxeRdIRMs5GcLYe8w4rONo/WgPr34JUHOC3o5WVZYfukUkExX8AuIPsYJMyleEoDper3JQKVpWsXIdtaWjZcTE7Sdmf0scW9aANzBktmEpNOO1Sj56+uIbJfPvlna9b2EqSevlycCX+EPyxNsmdjzvuUnzA/zDbdN3RD/vUqsizVFx5Fx6sF0/QaUWTlHsZVbe5hZgCWOtj8e6ejXdy1kqtPnZ+KK8dK1QnZQF+Pfn4YTwi4zcfP9r/nH748ZfxIGrffPy4hUzJ1SmFIPSC4+790i4oNjNtnK22En2dCwZDfsEH4MObLQ59uh/tBofDdRS9kQw3YVMs1VBygzEBhjSQmhEqa9RU9YqrnaIfV9FQpo2M3fCuHLcjytjjC72GfbJCnUb9k5gc3Ehx5YJO4QK38FFvcR3nFrqc5/SKhWwmbekKw3tyX2+urkvOCvSUMZFLrAGuiGCLVOHjgmnoBXWF8nFeMiog2TcFfShO+6b5k0RLlxj5qJdAaSVxcG178z3I8NfmUCbsxsUvpyznQ/Jw88giHwzdb4iey6pqhMM1ht7KK6Y803LRIyoNp3axI66ft/vpVsEpftiQv9GNh/ZW0Vswya3HCc34FbP3ivP2QfU/6dUm3artHkFDzOonkBZ+5VP+7dzXp6jz/XJ+CoGJJR7kRWx3cIRG3tElUxnh9dXRyP7/c/v/muUjUvNqRJjJ/3B66zq11a5jIGCECnqBNpRt0QshpycfTsiZ69NPPsBs5LFX6haLRWbByKSa7WHyB1R62/Od/XcRvv6D7OvcVGXH80nIuaGioKoAlPuKLf5bOLhcE1rymcAiAHjaPjDzYykXlu91xtPw3FtaIMcQWUTjUs6G1je4B88HCF1RoW/Q5uBmvTSgeoYOpzDabZfeLrRhtC3nwsjPOH5sfUuGDPCS0p4P8rgp6hExeY1nZJfnVQ2HI3vyhzsea8+HyeuBAJAaO3NsUdc9QVQjQ0VfWDSro1af9aMm3CiqeLl0aVJYtifdoTkXM40iQ8VzJX2aDm45LbVsMz3jl/XlsmYjwvMvaerylOZsIuXliJgFNwZj1WKu6S2jmpvGCS5tUdcrJooOhG3qUMjLZbksrGDhXM0hYRQFhL3C3hSnZxi9r1PwLDFqiP5ZcOVztf94NsV1tEd51ac9z7G2ouu8CNecnwbdOYR9zcBCNCIl8InfaG43Ppx6//r/LASDwb2H4YIrtrVSdq/94F5/8PKeUXQ65XkHgR+ZFUcxNbYVuY87V9HfES4msuldUX9HZGOGf+DCMJUql/iDZV+DPzQCSlIM1OCuaF1HVZxdYVkrJ+9C3ztStemCriTvKAjCIGqljAUrh/mzbsd5pAk41i3SrjhbDFUCH4bCo1cqUjPFK2aYWg1Vh4NEEHahSsCx/4W4wZDI7qcalrncZvUobyrVgqqCFRfbCUqNejSFJGuXlRb95JT1Wsmvw4aggx8Os4PsIDscKi0NypNZXmwvbeIEyuJgyWWAHXTSqGPO6RnWA3ZXAHXyHA3r6jJQ0nrxUvUvC+YLSoyU5S6dCakNz4l20mTceTOl4lIuulaId4wqgTnO1AT3xYybeTMBx4XdYqhLvxcQucuLXV2zfHAnHh0cz3/5e/3h6O3fv//p2fu/7L2cn6p/PfuSH/3bP/++/6dHm1jDt9C06VrjKloe4foArw/gfiKtQuz540DBnLHrgQRfu0qOcYcs/9xXzxmRsRdx3U9I2lwR3VSDCH36/OXAlXuXjlDX4sKNfmtsuO8H8NH+MoCR8OO1ODk8Su0wnRBbH1ScPt0w80eE0frJ8jXLOS09Tx2FbFFMmmiFYZe1GxrhFsyw3Iz8yPA6JtZfP9au1+fcLRLVGPQytxdvKckbbWQVUn5wHOiMDFkdbl2dDH8ppnwGFWyNJKoRN1inllNjJ4qKnPq0oylXbEHLUo/sza4ajXgxSD17tYL1wCA+TcXfVdE1qJnQUukRWbBJMnM0PERclFJrMjSoxdfJ2Xu3dmcO81sc28NoWa4xhznZCIeFKA4qliNEJa5Kh/3VvpAB7rFuL/01qOwWFCDvnTX6S8MaHJK8+fQOcs+kAFLwV4QrM5S2rXA0Emr6QEHEgkEZeLd6aAS5UTuXLv/5dv0Ge9Hz37BdZKCS3uTfMrttNRQ9jfXeYAgsEKdIWksPgHG31j7rcktaODo+9rZEquK03LJlMICBs7lYrj4wW8tlmqdt4sP2+CK615UPZsrlvFkW6e80b3FsR1vWTGd9t2Ey2NirBGo8ImPPhu3feaHhP7V2Nce/LuEvsizxZWTm9m8tQx72PvphH7KHHrKHHrKHHrKHNl3YQ/bQQ/bQQ/bQQ/bQQ/bQQ/bQfSDxIXvoIXvoIXvottlDUs2ocA5R96HX2Pq/bB4oFw/rr2MmFM/niD6w261quVbVVCztpYuICQPHmnQnvi1LW87OWVlDWVeqFBUz3+DFuJZCUXcYKjBIEcLPXP9IFxIa5o0Xc5so420G0MW71BXj/5a1yGKcZSnFdRpfr7AMbE5rd7UG9C0BK60AQxaAQf2/p/0P6P43oKABjf9+qegeNP2Vev69HYP1+v1NlreJbr9Cs78HsPs6/c1hv5E+v1Kbv8ti+nr8ulXcTYe/z1Sxtbr7TTZicyW3p7XfBeq1+vpN4N9IV48CyKCToIMSWfdZ8vA2reFXMuzQoTpb8SUV7S0PLbsg6MZ71JJOcRD/Hjpe82Iv4UQu5CdOa8B7xbfkzGpejImcGiaINnSpfdyYb0yNPeatMh3FJOWy5mhSgBqYpZzQMmpv6EGOBLab3Acb1+bbPK7gLOAn5equ+52ef1vBxoPTM01izhS03iBWHGZQIm6maOXkdEU0r3hJh8OoBhdSDyL0HhJ7/SpqCrUF+VDfCapmN8nkuxUWqZo1Vae3nv3zni6tkoOyMZJrraRhuQG3Pjf8ig17FiOU/vuO1vOdEdnZLe3/W0HH/td3fXu+8x/9RbOvLG+gM9K2ln4ygQ4aDJNx3Dn0TKCdfnBFe41WexMu9gapBbjftncMJhkIjLUrgN9GmOOFB8H45jtUhzViDO4rKjBMO+5YlHqwosKHhJKJkgsNflSfKueA8ThcsAmpoaOP77xpRWsx2FMFGgsW2V1OV5v2fni0sY8Q2imdvr7/RjztPXy4f/B8d//Z7uHTT/svj/efHT89yl4+e/pvG17Hn1xrpoQsXXueAbAXUl1yMbvA2K7Bzum3kSb25rJie7SM+xdcC7aDhQRYvOU1XNmJ6OCs66no8DF5uKno0HaFY9iA2xf2ntKcl9xYEaDmVxIIlyrZiMLe/JxhBwVsJ+yHAx86/Ka7/VVcJoFmDBp/V1QsrUqUsxCOQz7Fk4YxseEj+PhREa5GBHL8QiA2HiLuJABdSwFSvEubbEXbsUNbFnnfT6DnrmKGxa1L26AYpkdRQuqEkUYUTIEqGgKf1MgFwI7i6NcRyUsOHXn8S1ac8VF/cYRxRk6x8Y5bFi1LCJ01sgWZ1+MRCmYUJCXh8AJIoS495fSMGMWvOC3L5YgISSpqDGRMQiSEgQmoguaZyxDfH09yTLNJlmfF+Db12QdCk1YeoE3Dk07KkO9tUQLkI31x2Cj5OwqM6UVEnt8iHtJ9NJCW6igM6thGce25FMIlFADzx4g0xWZUFRjSp6Hzyih6E9NiJjxEl1p5FpPZcqkKjV3zPr06C62CsC+xhwzByRm3/3ZY4oJDe8Lzv3xwEa2PdehrYYdqp8fhsSZvyL/rzuGKv5fL/uI7WRNC+9bvwAZcKCKhuWm8iRU7wDFVkZ0w0g52EZi6uB4/s+gAq30FbvjZqSzeHjyQvuur8ubIuHRn8Bh21932PBmaQpt1hLwNjuQQOPpbI/JWD8Jj7r4bGqZFoZAmGszSCW7RLhrUe72aX+HQex7wtCUHqmy0sLy7osLw3OdPeLfrV2wLMWpbe1sFb9qU9oUrbpfHf2eRFViQnCnQH9tkMc+eVBh9SstSh5aQOTVsJtUS+ZPLsNaGlyVhAppUw2srcgQsgqYcdA5a10rWikM76VswIMeytyVGYoAY9vzD7Qh3BKbfez5RTfiskY0ul0izrj0i74Sz6KBzQUgaeLxHhPqy9MDXGyhoLy2NZIT8pcUv1nBPxzPS5fQpumiTSJDWx5l7MPZO9a4MIuwF0ebHFw0G6aIGM7YXkAVpnCF4Y3vX2dsKCh64Fg3JkNAU1ooUQ+bz7Uex+ujR5LVXeId3vBLk9OzqyD44Pbt63m7qANw3SAS+gUIrlVkJ9bcPPV4JAm78NqBwLBMnyP5GuTJtVtXLo83A/jMkz0DvmzYh1sWUol6HV8MQId0lk6WFdEPl7cxlttwK1Idwoodwov6qHsKJHsKJNkXiQzjRQzjRQzjRbcOJXCmOvkmjfbh5YIev69HVn038m1QQ3GPvzbbzGsYY0dgbV5YQubEqUGjKReGKynlfIhTnQYuVv+MjOx9Ob7/o5D3dsUngvXXYioJyfLHGRgi07gDwg122C69VYcOtMnRZXSIV+m/x9YpeMm0Vp1pqzVNnDoHKcSk2o8RY3DkRFXMcBiv06PJmR8UgDEdxJnLwT2jdMI3WDTueYoVdiGv6B3p+MqAV41wsmO+kzQvf+jtkZIqi3X+0CHAxg4ajrpngd0MybvH0BXvGJlO2T9nz/OiHF4fFhP0w3T94cUQPnj99MZm8PDx6MR0o3XSnTMXWKcFKqg3P0dy661azoUciFno8fbeJa+78rMhdi3la+Biy2VyDP+jiC4bfUDOrlAsN3G0hk+E8ilslDxrd+ROnWkL2rS7t764ZWEqAyJVF4vvCoEHXLW/siU5gm7fk85MSaxM6UC0pFFwbxSeNHcKXQkL6UA3YeoOaPpfaaGLSpbXHAe2T3k7nF4wlRtyyBjzfruIcFLORU/Im3u0Y9bAcl3TuYyxQb2q06SSqoZvwR6nInxk1uj8M1xZbBZvSpjRQ66IOHp+AP0ua42Rc59GYEiGJHyd0K7zvJnMrTsBNfHFR7uaNqR8+9j4XV1AAu7EOXCkJE7T3luyQrZ/ejrqGG8JgnSzyFNKUQEad3Qo1t5IZxgkCx8MeVLOVFNpXrgMjTNDZi5sEg92YZp5mh9mmrfT+xYfapaQSSx3X0UvL/aCMlby0oiV1kcnMYNPoVPBoI/ymhA4RywB+WD1nFVO03GJVnTd+jp640coK5DGfws3MvnJtOrl5rdzR9oIFN4AmNFdSa6IYeMVdxblAwrwYk0JC99vhOv8v6dH02f7+tCOggmG/I5/GzzYTT/GTTTw7oX0/dXa0vaQOa3eozT05sV/CuXNuLoF+Qy+E86g8eCH+uF4ILA30P80L0YX6b+CFWAXCFr0QeJz+V3ghcCnOtB+XovqDuiJuAO+DP+LBH9Ff1YM/4sEfsSkSH/wRD/6IB3/ETfwRib7XqDJV9j5/fLdetfv88Z2/YWslr3jBsL5rXTLD7K+YOEh0blXfkYuuhcqx1MxvoYOt7thzX0m62AeGFW0rnUZBZVsf4GzmqZrW2aAP0ri4OC4GKkCO4oJnBSCwwrwSip1rLNKSASHGl4KmRXOIfC/lzFGb/Zxrl2/1W6NNG0joi3wiovtWhNB7JsSFh0/D0BT8FQuqA8CjsLtdqWiVaSHFb9x7whnPslweHx093UMj2j9++VNiVPveyNoOv+LnLaSgrlMDp2GPUCfnlVXZHP4gkrLRaHIeIVtpFd6QRp+MOG5UmdkxxyO70RCxa5LtUSyXQhvVgI1MKuI3CUkxPeEJWQ5sxq3QP2DVhOO8NUMIjN5pbjcKLQp2YBE7A8fuGFMRj8e+pVJNI9UXRl2Nlc0V0vtZ5Wtnhlm1ynSLuss9FZjRZEnNnnLPR1y4tXR6iKvbCg0EMBa9XLa53Klx1NmF0MUBzhPof+FIOalsDjQ9k6HPl7PZ9NWegOJ0NZtaPlYnGQjDZolvZkMDSA/PR0dPh/uGHj0d0qjNfFv0cAZtsFZRgzueOwNqM2R7bAsqe6BgAseQgiADcOIvmAPdhT0ZJqyjw166ZA3n9x/h/LKvUHc5aggQzwah60j2vg1cMpCQdhyg3FAqNFoHfB5+ozDnpDHhrRR600EC2ubbXmFVbVq4YAn4RurjwxE6jq/E00omzCyY6xpgFhJP91BtAkVn1RZb1toTE/ltQACaGpfHMf5+HBGmkfXgJn4/yIQ94ANrajRT28yR/uzG79DpoN1M686493zScfxhSGJ8dKRxfcNcJ7sREEvQdb0M13yBV1Fyhf7m7IpGJGYkaUXfzPcZDb0UwWcFWm1s+bZPOMNEk/a2gYnmVGOfBjOnAq35xajVIgSUI1p6SRp4AbgCiZy2MM03rExjVHNdYRoMk04eRebK5HmvXM1ASZvUd/a3DnP6peORaLphT8E8b/dm4EzcT8gNLScsuefXSYFze237KgWlnLXC0goYrRjdtTHdId33BIAlb6BVWyIHXsNlHmnUElzxmSmhV5SXmD/fA5pVlG9Pm7UHDWbwstsABHOqtybUuPA6f+DnaZhbzIbQhQ8vQqUxKZYVdK+yr3QumM+aTZvSYnYMpAAlR5T7BwQnhUAeaAYBVE7LlO11OjblVNjLyl3NQ96Jju3e+yc6j29eoBtjXyKX9oBCDu+44CkI6nLc2UngfSXwVr6HFVxoPVWso4xrVk/WVkVDvPiwNUj63POltrJhsHsWxy0CHrsZANSB+zstYdbe4iR+frO7HIf05NLGgVhl0FXn8UUpvFxhv12ijSgMp+dy4bo6L9gkRJ9AmFRUeB8rFVBlpdUmAB6qHsVI/IOY7xywV2nkUYu5QWVv5738nZcl3XuW7ZPH/GwuBfsH8ursM8G/k1/OycHhxQG2a/QF1Z6Qk7ou2a9s8jM3e8/3n2UH2cEz8vjnt5/evxvhuz+x/FI+8YFQeweH2T55Lye8ZHsHz94cHL0k53RKFd97vg/VtTa8eG9zn+FEm+ExJu5232/QKuN+tvNf+rvYhSTxVGf7A1YcFqIz7wePSBI3x6MDZOBQPLSAeGgBEWHtoQXEQwuIhxYQKzfo/7sWEN+HFplWQ4lbnH1PPv3y+pfjoT6Xzsy6x3K9h1k/ewcvXiYSKt6kndZfQyhYsaZuYy93M3+3az8/JhNGLdt2F9qf8V8DQ71y9lvoCyoFfBfUIa85g1JYukIqrrHTd2k/txC7x6jJDK/Y7+01jauiJQ9pbjU182OnK3VervhMUYQQ7EbJ6DhjMqyc/MZyf0PhPy5ugMawfhBvfPdCWLQPVU4gYEqFJmn9u3DFJG/sRx0pAMrnFAV39YmsTADB0y5hBuYJcdKrOud1MlFuExYPoEX5G8lG9kizv4mWguP31u4fDDpI8/2BBw9Id3RH7Xkpm6Il91f2n96aCWkntKCGDp+A9+5XVLny5FNtt6jNwaJFcQEvXPghfSE5qeIDkawZPshqJS1ptvUFA09zv+x+XU9DsTDrPrH08pOUs5LhigPHOrHIxLTFsogPTQg4ZoZmATBY6jW7Mfjy2r2O5vBpY216x/ppQupieP/GM21AYJ25NqXhaDaXyXcRHcP1k7kPsuiDTedyzJiX3CwvNmCu67/adFZHaZtuXI/KN50H4+o2miN5dQU/KGR+CVTqGMJr/++Bw4W/QSpXNx/K/WaPtp5LZS7wfmjVLSryuVR+vt3ADFZcjgEsstZw4498HL1LuQBba4/bx2iKUDX8yeB2rJiqorP+3XLtbParrrp/g1k7X2426e2nK+mElboV5d7KBTGSVLS2fFazf+zBkogbZL3IQa6JZ7K4IghC5inX6eGObt/ivwYGObXyQkStzmxrP/cJxllEoPb5EHmS//xvP/NlM7HyMOZNuPl/jp8NQNH+Hi7Z9MZsByXx7OtPU/vRtScqAfpmp6qWxTC53WgTIwzUskDjwOBUzcDZve1MZ7Ign09fD9srdU3z+1tUO2J/Mln0jvodJ/PqfX8yPCbXH8fNJnLnvqID4XXgisISjfc1XTTk8JzXMMDb4jMMuwKp13H7u8+L4zoO03Zm6HVlGBjXlxcPjCXIsUOMoNP1YWMuwL5uet/4ktGD9eBXyCGlnLWrfSdnZMpLzItBq+o6hbz0r5dcpPp2svBSzjL7WhaFxw3tnmJfGq5YkdqK1/i7YO5OtRoLCkQkQ630OJTZx4GhnjRU0B6ADDP82FZyPybjvSuq9ko523Om71LOxll/nS62Nk0FvvNiz5N8396S5czn+Lp1Q91Yl2Y3AKScTjVLOydF2X232wYc08Ur1VIZaLgtGJZh14T26jUbxWh1XxiylIsjksWcCcACF7PonGNQvAuve6RNIRvziEgFf2dKPUrB46JuTKwFteBEwUJrsAIDYDGLzn61e4X1gV0lpTioG1CJRAmlzttiH2EOL0+Nsf6ExLQWl3+Ak2tXltrp5D/ykoHxDKUaR+7JqtHepdmXholOdNJdKMQP6PJeQlGDwTreSw0MA+vBL++PSt2AhH01irYKFForuFTcLIdB8b/eGyh+wBB6DvOsw4ZmV8x+cQFiwX3y0HlTUTwuYFH0E63flK2D4ScabpyUuR419wmASI1XdvgBzjktaegvc31jheTGgU/9DENbPTemzrA4umaZu4EvSiZmnVtzwMKZfDqRxTKL08vXmjhu0EoP/zXglh5yua4SZ4ai8NIdTMCzTEqzATvvRrbzTzHbc0NhlFRgvas5kZ+6kkVTbuYpSF5di3ZL6hdQfsPQqt5o8FyxqM1Hd/T/FwAA///pyxQn" } diff --git a/filebeat/input/syslog/event.go b/filebeat/input/syslog/event.go index 1ffcf074a756..6a83a69d653e 100644 --- a/filebeat/input/syslog/event.go +++ b/filebeat/input/syslog/event.go @@ -71,6 +71,7 @@ type event struct { nanosecond int year int loc *time.Location + sequence int } // newEvent() return a new event. @@ -84,6 +85,7 @@ func newEvent() *event { minute: -1, second: -1, year: time.Now().Year(), + sequence: -1, } } @@ -269,6 +271,17 @@ func (s *event) HasPid() bool { return s.pid > 0 } +// SetSequence set the sequence number for this event. +func (s *event) SetSequence(b []byte) { + s.sequence = bytesToInt(b) +} + +// Sequence returns the sequence number of the event when defined, +// otherwise return -1. +func (s *event) Sequence() int { + return s.sequence +} + // SetNanoSecond sets the nanosecond. func (s *event) SetNanosecond(b []byte) { // We assume that we receive a byte array representing a nanosecond, this might not be diff --git a/filebeat/input/syslog/input.go b/filebeat/input/syslog/input.go index 3750d2e5df77..f03f5c1b300e 100644 --- a/filebeat/input/syslog/input.go +++ b/filebeat/input/syslog/input.go @@ -37,6 +37,7 @@ import ( // Parser is generated from a ragel state machine using the following command: //go:generate ragel -Z -G2 parser.rl -o parser.go +//go:generate go fmt parser.go // Severity and Facility are derived from the priority, theses are the human readable terms // defined in https://tools.ietf.org/html/rfc3164#section-4.1.1. @@ -250,6 +251,10 @@ func createEvent(ev *event, metadata inputsource.NetworkMetadata, timezone *time f["event"] = event f["process"] = process + if ev.Sequence() != -1 { + f["event.sequence"] = ev.Sequence() + } + return &beat.Event{ Timestamp: ev.Timestamp(timezone), Meta: common.MapStr{ diff --git a/filebeat/input/syslog/input_test.go b/filebeat/input/syslog/input_test.go index 2b1d64184bb2..0387feb0bd81 100644 --- a/filebeat/input/syslog/input_test.go +++ b/filebeat/input/syslog/input_test.go @@ -174,6 +174,32 @@ func TestProgram(t *testing.T) { }) } +func TestSequence(t *testing.T) { + t.Run("is set", func(t *testing.T) { + e := newEvent() + e.SetMessage([]byte("hello world")) + e.SetProgram([]byte("sudo")) + e.SetSequence([]byte("123")) + m := dummyMetadata() + event := createEvent(e, m, time.Local, logp.NewLogger("syslog")) + v, err := event.GetValue("event.sequence") + if !assert.NoError(t, err) { + return + } + assert.Equal(t, v, 123) + }) + + t.Run("is not set", func(t *testing.T) { + e := newEvent() + e.SetMessage([]byte("hello world")) + m := dummyMetadata() + event := createEvent(e, m, time.Local, logp.NewLogger("syslog")) + + _, err := event.GetValue("event.sequence") + assert.Error(t, err) + }) +} + func dummyMetadata() inputsource.NetworkMetadata { ip := "127.0.0.1" parsedIP := net.ParseIP(ip) diff --git a/filebeat/input/syslog/parser.go b/filebeat/input/syslog/parser.go index 674ad5930d1b..f643bc7d7b36 100644 --- a/filebeat/input/syslog/parser.go +++ b/filebeat/input/syslog/parser.go @@ -21,28 +21,31 @@ package syslog //line parser.go:8 const syslog_start int = 0 -const syslog_first_final int = 1 +const syslog_first_final int = 2 const syslog_error int = -1 const syslog_en_main int = 0 +const syslog_en_catch_all int = 1 //line parser.rl:9 -// syslog -//<34>Oct 11 22:14:15 wopr su: 'su root' failed for foobar -//<13>Feb 5 17:32:18 10.0.0.99 Use the quad dmg. +var ( + noDuplicates = []byte{'-', '.'} +) + +// Parse parses Syslog events. func Parse(data []byte, event *event) { var p, cs int pe := len(data) tok := 0 eof := len(data) -//line parser.go:28 +//line parser.go:31 { cs = syslog_start } -//line parser.go:33 +//line parser.go:36 { if (p) == (pe) { goto _test_eof @@ -50,8 +53,6 @@ func Parse(data []byte, event *event) { switch cs { case 0: goto st_case_0 - case 1: - goto st_case_1 case 2: goto st_case_2 case 3: @@ -262,6 +263,36 @@ func Parse(data []byte, event *event) { goto st_case_105 case 106: goto st_case_106 + case 107: + goto st_case_107 + case 108: + goto st_case_108 + case 109: + goto st_case_109 + case 110: + goto st_case_110 + case 111: + goto st_case_111 + case 112: + goto st_case_112 + case 113: + goto st_case_113 + case 114: + goto st_case_114 + case 115: + goto st_case_115 + case 116: + goto st_case_116 + case 117: + goto st_case_117 + case 118: + goto st_case_118 + case 119: + goto st_case_119 + case 1: + goto st_case_1 + case 120: + goto st_case_120 } goto st_out st_case_0: @@ -290,20 +321,17 @@ func Parse(data []byte, event *event) { } goto tr0 tr0: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st1 - st1: - if (p)++; (p) == (pe) { - goto _test_eof1 - } - st_case_1: -//line parser.go:291 - goto st1 - tr1: -//line parser.rl:20 + goto st2 + tr75: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 tok = p @@ -313,58 +341,70 @@ func Parse(data []byte, event *event) { goto _test_eof2 } st_case_2: -//line parser.go:304 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st3 - } - goto st1 +//line parser.go:332 + goto st2 + tr1: +//line parser.rl:22 + + tok = p + + goto st3 st3: if (p)++; (p) == (pe) { goto _test_eof3 } st_case_3: +//line parser.go:345 + if data[(p)] == 58 { + goto st48 + } if 48 <= data[(p)] && data[(p)] <= 57 { goto st4 } - goto st1 + goto st2 st4: if (p)++; (p) == (pe) { goto _test_eof4 } st_case_4: + if data[(p)] == 58 { + goto st48 + } if 48 <= data[(p)] && data[(p)] <= 57 { goto st5 } - goto st1 + goto st2 st5: if (p)++; (p) == (pe) { goto _test_eof5 } st_case_5: - if data[(p)] == 45 { - goto tr15 + if data[(p)] == 58 { + goto st48 } - goto st1 - tr15: -//line parser.rl:36 - - event.SetYear(data[tok:p]) - - goto st6 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st6 + } + goto st2 st6: if (p)++; (p) == (pe) { goto _test_eof6 } st_case_6: -//line parser.go:347 + switch data[(p)] { + case 45: + goto tr17 + case 58: + goto st48 + } if 48 <= data[(p)] && data[(p)] <= 57 { - goto tr16 + goto st47 } - goto st1 - tr16: -//line parser.rl:20 + goto st2 + tr17: +//line parser.rl:38 - tok = p + event.SetYear(data[tok:p]) goto st7 st7: @@ -372,40 +412,40 @@ func Parse(data []byte, event *event) { goto _test_eof7 } st_case_7: -//line parser.go:363 +//line parser.go:403 if 48 <= data[(p)] && data[(p)] <= 57 { - goto st8 + goto tr19 } - goto st1 + goto st2 + tr19: +//line parser.rl:22 + + tok = p + + goto st8 st8: if (p)++; (p) == (pe) { goto _test_eof8 } st_case_8: - if data[(p)] == 45 { - goto tr18 +//line parser.go:419 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st9 } - goto st1 - tr18: -//line parser.rl:40 - - event.SetMonthNumeric(data[tok:p]) - - goto st9 + goto st2 st9: if (p)++; (p) == (pe) { goto _test_eof9 } st_case_9: -//line parser.go:388 - if 48 <= data[(p)] && data[(p)] <= 51 { - goto tr19 + if data[(p)] == 45 { + goto tr21 } - goto st1 - tr19: -//line parser.rl:20 + goto st2 + tr21: +//line parser.rl:42 - tok = p + event.SetMonthNumeric(data[tok:p]) goto st10 st10: @@ -413,92 +453,92 @@ func Parse(data []byte, event *event) { goto _test_eof10 } st_case_10: -//line parser.go:404 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st11 +//line parser.go:444 + if 48 <= data[(p)] && data[(p)] <= 51 { + goto tr22 } - goto st1 + goto st2 + tr22: +//line parser.rl:22 + + tok = p + + goto st11 st11: if (p)++; (p) == (pe) { goto _test_eof11 } st_case_11: +//line parser.go:460 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st12 + } + goto st2 + st12: + if (p)++; (p) == (pe) { + goto _test_eof12 + } + st_case_12: switch data[(p)] { case 32: - goto tr21 + goto tr24 case 84: - goto tr21 + goto tr24 case 116: - goto tr21 + goto tr24 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr21 + goto tr24 } - goto st1 - tr21: -//line parser.rl:44 + goto st2 + tr24: +//line parser.rl:46 event.SetDay(data[tok:p]) - goto st12 - st12: + goto st13 + st13: if (p)++; (p) == (pe) { - goto _test_eof12 + goto _test_eof13 } - st_case_12: -//line parser.go:437 + st_case_13: +//line parser.go:493 if data[(p)] == 50 { - goto tr23 + goto tr26 } if 48 <= data[(p)] && data[(p)] <= 49 { - goto tr22 + goto tr25 } - goto st1 - tr22: -//line parser.rl:20 + goto st2 + tr25: +//line parser.rl:22 tok = p - goto st13 - st13: - if (p)++; (p) == (pe) { - goto _test_eof13 - } - st_case_13: -//line parser.go:456 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st14 - } - goto st1 + goto st14 st14: if (p)++; (p) == (pe) { goto _test_eof14 } st_case_14: - if data[(p)] == 58 { - goto tr25 +//line parser.go:512 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st15 } - goto st1 - tr25: -//line parser.rl:48 - - event.SetHour(data[tok:p]) - - goto st15 + goto st2 st15: if (p)++; (p) == (pe) { goto _test_eof15 } st_case_15: -//line parser.go:481 - if 48 <= data[(p)] && data[(p)] <= 53 { - goto tr26 + if data[(p)] == 58 { + goto tr28 } - goto st1 - tr26: -//line parser.rl:20 + goto st2 + tr28: +//line parser.rl:50 - tok = p + event.SetHour(data[tok:p]) goto st16 st16: @@ -506,40 +546,40 @@ func Parse(data []byte, event *event) { goto _test_eof16 } st_case_16: -//line parser.go:497 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st17 +//line parser.go:537 + if 48 <= data[(p)] && data[(p)] <= 53 { + goto tr29 } - goto st1 + goto st2 + tr29: +//line parser.rl:22 + + tok = p + + goto st17 st17: if (p)++; (p) == (pe) { goto _test_eof17 } st_case_17: - if data[(p)] == 58 { - goto tr28 +//line parser.go:553 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st18 } - goto st1 - tr28: -//line parser.rl:52 - - event.SetMinute(data[tok:p]) - - goto st18 + goto st2 st18: if (p)++; (p) == (pe) { goto _test_eof18 } st_case_18: -//line parser.go:522 - if 48 <= data[(p)] && data[(p)] <= 53 { - goto tr29 + if data[(p)] == 58 { + goto tr31 } - goto st1 - tr29: -//line parser.rl:20 + goto st2 + tr31: +//line parser.rl:54 - tok = p + event.SetMinute(data[tok:p]) goto st19 st19: @@ -547,99 +587,132 @@ func Parse(data []byte, event *event) { goto _test_eof19 } st_case_19: -//line parser.go:538 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st20 +//line parser.go:578 + if 48 <= data[(p)] && data[(p)] <= 53 { + goto tr32 } - goto st1 + goto st2 + tr32: +//line parser.rl:22 + + tok = p + + goto st20 st20: if (p)++; (p) == (pe) { goto _test_eof20 } st_case_20: +//line parser.go:594 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st21 + } + goto st2 + st21: + if (p)++; (p) == (pe) { + goto _test_eof21 + } + st_case_21: switch data[(p)] { case 32: - goto tr31 + goto tr34 case 43: - goto tr32 + goto tr35 case 45: - goto tr32 + goto tr35 case 46: - goto tr33 + goto tr36 + case 58: + goto tr37 case 90: - goto tr34 + goto tr38 case 122: - goto tr34 + goto tr38 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr31 + goto tr34 } - goto st1 - tr31: -//line parser.rl:56 + goto st2 + tr34: +//line parser.rl:58 event.SetSecond(data[tok:p]) - goto st21 - tr49: -//line parser.rl:76 + goto st22 + tr61: +//line parser.rl:93 event.SetTimeZone(data[tok:p]) - goto st21 - tr54: -//line parser.rl:60 + goto st22 + tr68: +//line parser.rl:62 event.SetNanosecond(data[tok:p]) - goto st21 - st21: - if (p)++; (p) == (pe) { - goto _test_eof21 - } - st_case_21: -//line parser.go:589 - switch { - case data[(p)] > 95: - if 97 <= data[(p)] && data[(p)] <= 122 { - goto tr35 - } - case data[(p)] >= 46: - goto tr35 - } - goto tr0 - tr35: -//line parser.rl:20 - - tok = p - goto st22 st22: if (p)++; (p) == (pe) { goto _test_eof22 } st_case_22: -//line parser.go:610 - if data[(p)] == 32 { - goto tr36 +//line parser.go:647 + switch data[(p)] { + case 58: + goto tr41 + case 95: + goto tr39 } switch { - case data[(p)] < 46: - if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr36 + case data[(p)] < 48: + if 45 <= data[(p)] && data[(p)] <= 46 { + goto tr39 } - case data[(p)] > 95: - if 97 <= data[(p)] && data[(p)] <= 122 { - goto st22 + case data[(p)] > 57: + switch { + case data[(p)] > 90: + if 97 <= data[(p)] && data[(p)] <= 122 { + goto tr40 + } + case data[(p)] >= 65: + goto tr40 } default: - goto st22 + goto tr40 } - goto st1 - tr36: -//line parser.rl:64 + goto tr0 + tr39: +//line parser.rl:22 - event.SetHostname(data[tok:p]) + tok = p + +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + + goto st23 + tr42: +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } goto st23 st23: @@ -647,49 +720,106 @@ func Parse(data []byte, event *event) { goto _test_eof23 } st_case_23: -//line parser.go:638 +//line parser.go:707 switch data[(p)] { - case 32: - goto tr0 - case 91: - goto tr0 - case 93: - goto tr0 + case 58: + goto tr44 + case 95: + goto tr42 } - if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr0 + switch { + case data[(p)] < 48: + if 45 <= data[(p)] && data[(p)] <= 46 { + goto tr42 + } + case data[(p)] > 57: + switch { + case data[(p)] > 90: + if 97 <= data[(p)] && data[(p)] <= 122 { + goto tr43 + } + case data[(p)] >= 65: + goto tr43 + } + default: + goto tr43 } - goto tr38 - tr38: -//line parser.rl:20 + goto st2 + tr40: +//line parser.rl:22 tok = p +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + + goto st24 + tr43: +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + goto st24 st24: if (p)++; (p) == (pe) { goto _test_eof24 } st_case_24: -//line parser.go:662 +//line parser.go:767 switch data[(p)] { case 32: - goto st1 + goto tr45 case 58: - goto tr40 - case 91: - goto tr41 - case 93: - goto st1 + goto tr46 + case 95: + goto tr42 } - if 9 <= data[(p)] && data[(p)] <= 13 { - goto st1 + switch { + case data[(p)] < 48: + switch { + case data[(p)] > 13: + if 45 <= data[(p)] && data[(p)] <= 46 { + goto tr42 + } + case data[(p)] >= 9: + goto tr45 + } + case data[(p)] > 57: + switch { + case data[(p)] > 90: + if 97 <= data[(p)] && data[(p)] <= 122 { + goto tr43 + } + case data[(p)] >= 65: + goto tr43 + } + default: + goto tr43 } - goto st24 - tr40: -//line parser.rl:68 + goto st2 + tr45: +//line parser.rl:81 - event.SetProgram(data[tok:p]) + event.SetHostname(data[tok:p]) goto st25 st25: @@ -697,29 +827,47 @@ func Parse(data []byte, event *event) { goto _test_eof25 } st_case_25: -//line parser.go:688 +//line parser.go:810 switch data[(p)] { case 32: - goto st26 - case 58: - goto tr40 + goto tr0 case 91: - goto tr41 + goto tr0 case 93: - goto st1 + goto tr0 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto st26 + goto tr0 } - goto st24 + goto tr47 + tr47: +//line parser.rl:22 + + tok = p + + goto st26 st26: if (p)++; (p) == (pe) { goto _test_eof26 } st_case_26: - goto tr0 - tr41: -//line parser.rl:68 +//line parser.go:834 + switch data[(p)] { + case 32: + goto st2 + case 58: + goto tr49 + case 91: + goto tr50 + case 93: + goto st2 + } + if 9 <= data[(p)] && data[(p)] <= 13 { + goto st2 + } + goto st26 + tr49: +//line parser.rl:85 event.SetProgram(data[tok:p]) @@ -729,34 +877,31 @@ func Parse(data []byte, event *event) { goto _test_eof27 } st_case_27: -//line parser.go:720 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto tr43 +//line parser.go:860 + switch data[(p)] { + case 32: + goto st28 + case 58: + goto tr49 + case 91: + goto tr50 + case 93: + goto st2 } - goto st1 - tr43: -//line parser.rl:20 - - tok = p - - goto st28 + if 9 <= data[(p)] && data[(p)] <= 13 { + goto st28 + } + goto st26 st28: if (p)++; (p) == (pe) { goto _test_eof28 } st_case_28: -//line parser.go:736 - if data[(p)] == 93 { - goto tr45 - } - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st28 - } - goto st1 - tr45: -//line parser.rl:72 + goto tr0 + tr50: +//line parser.rl:85 - event.SetPid(data[tok:p]) + event.SetProgram(data[tok:p]) goto st29 st29: @@ -764,41 +909,34 @@ func Parse(data []byte, event *event) { goto _test_eof29 } st_case_29: -//line parser.go:755 - if data[(p)] == 58 { - goto st30 +//line parser.go:892 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto tr52 } - goto st1 + goto st2 + tr52: +//line parser.rl:22 + + tok = p + + goto st30 st30: if (p)++; (p) == (pe) { goto _test_eof30 } st_case_30: - if data[(p)] == 32 { - goto st26 +//line parser.go:908 + if data[(p)] == 93 { + goto tr54 } - if 9 <= data[(p)] && data[(p)] <= 13 { - goto st26 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st30 } - goto st1 - tr32: -//line parser.rl:56 - - event.SetSecond(data[tok:p]) - -//line parser.rl:20 - - tok = p - - goto st31 - tr55: -//line parser.rl:60 - - event.SetNanosecond(data[tok:p]) - -//line parser.rl:20 + goto st2 + tr54: +//line parser.rl:89 - tok = p + event.SetPid(data[tok:p]) goto st31 st31: @@ -806,177 +944,313 @@ func Parse(data []byte, event *event) { goto _test_eof31 } st_case_31: -//line parser.go:797 - if 48 <= data[(p)] && data[(p)] <= 57 { +//line parser.go:927 + if data[(p)] == 58 { goto st32 } - goto st1 + goto st2 st32: if (p)++; (p) == (pe) { goto _test_eof32 } st_case_32: - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st33 + if data[(p)] == 32 { + goto st28 } - goto st1 + if 9 <= data[(p)] && data[(p)] <= 13 { + goto st28 + } + goto st2 + tr46: +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + +//line parser.rl:81 + + event.SetHostname(data[tok:p]) + + goto st33 st33: if (p)++; (p) == (pe) { goto _test_eof33 } st_case_33: +//line parser.go:966 switch data[(p)] { case 32: - goto tr49 + goto st25 case 58: - goto st36 + goto tr57 + case 95: + goto tr42 } switch { - case data[(p)] > 13: - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st34 + case data[(p)] < 48: + switch { + case data[(p)] > 13: + if 45 <= data[(p)] && data[(p)] <= 46 { + goto tr42 + } + case data[(p)] >= 9: + goto st25 + } + case data[(p)] > 57: + switch { + case data[(p)] > 90: + if 97 <= data[(p)] && data[(p)] <= 122 { + goto tr43 + } + case data[(p)] >= 65: + goto tr43 + } + default: + goto tr43 + } + goto st2 + tr57: +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + + goto st34 + tr58: +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } } - case data[(p)] >= 9: - goto tr49 } - goto st1 + +//line parser.rl:81 + + event.SetHostname(data[tok:p]) + + goto st34 st34: if (p)++; (p) == (pe) { goto _test_eof34 } st_case_34: - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st35 +//line parser.go:1033 + switch data[(p)] { + case 32: + goto tr45 + case 58: + goto tr58 + case 95: + goto tr42 + } + switch { + case data[(p)] < 48: + switch { + case data[(p)] > 13: + if 45 <= data[(p)] && data[(p)] <= 46 { + goto tr42 + } + case data[(p)] >= 9: + goto tr45 + } + case data[(p)] > 57: + switch { + case data[(p)] > 90: + if 97 <= data[(p)] && data[(p)] <= 122 { + goto tr43 + } + case data[(p)] >= 65: + goto tr43 + } + default: + goto tr43 } - goto st1 + goto st2 + tr41: +//line parser.rl:22 + + tok = p + +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + + goto st35 + tr44: +//line parser.rl:70 + + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok - 1 + { + goto st1 + } + } + } + } + + goto st35 st35: if (p)++; (p) == (pe) { goto _test_eof35 } st_case_35: - if data[(p)] == 32 { - goto tr49 +//line parser.go:1100 + switch data[(p)] { + case 58: + goto tr57 + case 95: + goto tr42 } - if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr49 + switch { + case data[(p)] < 48: + if 45 <= data[(p)] && data[(p)] <= 46 { + goto tr42 + } + case data[(p)] > 57: + switch { + case data[(p)] > 90: + if 97 <= data[(p)] && data[(p)] <= 122 { + goto tr43 + } + case data[(p)] >= 65: + goto tr43 + } + default: + goto tr43 } - goto st1 + goto st2 + tr35: +//line parser.rl:58 + + event.SetSecond(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st36 + tr69: +//line parser.rl:62 + + event.SetNanosecond(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st36 st36: if (p)++; (p) == (pe) { goto _test_eof36 } st_case_36: +//line parser.go:1150 if 48 <= data[(p)] && data[(p)] <= 57 { - goto st34 + goto st37 } - goto st1 - tr33: -//line parser.rl:56 - - event.SetSecond(data[tok:p]) - - goto st37 + goto st2 st37: if (p)++; (p) == (pe) { goto _test_eof37 } st_case_37: -//line parser.go:872 if 48 <= data[(p)] && data[(p)] <= 57 { - goto tr53 + goto st38 } - goto st1 - tr53: -//line parser.rl:20 - - tok = p - - goto st38 + goto st2 st38: if (p)++; (p) == (pe) { goto _test_eof38 } st_case_38: -//line parser.go:888 switch data[(p)] { case 32: - goto tr54 - case 43: - goto tr55 - case 45: - goto tr55 - case 90: - goto tr57 - case 122: - goto tr57 + goto tr61 + case 58: + goto tr63 } switch { case data[(p)] > 13: if 48 <= data[(p)] && data[(p)] <= 57 { - goto st38 + goto st39 } case data[(p)] >= 9: - goto tr54 + goto tr61 } - goto st1 - tr34: -//line parser.rl:56 - - event.SetSecond(data[tok:p]) - -//line parser.rl:20 - - tok = p - - goto st39 - tr57: -//line parser.rl:60 - - event.SetNanosecond(data[tok:p]) - -//line parser.rl:20 - - tok = p - - goto st39 + goto st2 st39: if (p)++; (p) == (pe) { goto _test_eof39 } st_case_39: -//line parser.go:935 - switch data[(p)] { - case 32: - goto tr49 - case 43: - goto st31 - case 45: - goto st31 - } - if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr49 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st40 } - goto st1 - tr23: -//line parser.rl:20 - - tok = p - - goto st40 + goto st2 st40: if (p)++; (p) == (pe) { goto _test_eof40 } st_case_40: -//line parser.go:959 - if 48 <= data[(p)] && data[(p)] <= 51 { - goto st14 + switch data[(p)] { + case 32: + goto tr61 + case 58: + goto tr65 } - goto st1 - tr2: -//line parser.rl:20 + if 9 <= data[(p)] && data[(p)] <= 13 { + goto tr61 + } + goto st2 + tr37: +//line parser.rl:58 - tok = p + event.SetSecond(data[tok:p]) + + goto st41 + tr65: +//line parser.rl:93 + + event.SetTimeZone(data[tok:p]) + + goto st41 + tr71: +//line parser.rl:62 + + event.SetNanosecond(data[tok:p]) goto st41 st41: @@ -984,15 +1258,18 @@ func Parse(data []byte, event *event) { goto _test_eof41 } st_case_41: -//line parser.go:975 - if 48 <= data[(p)] && data[(p)] <= 57 { - goto tr59 +//line parser.go:1231 + if data[(p)] == 32 { + goto st22 + } + if 9 <= data[(p)] && data[(p)] <= 13 { + goto st22 } - goto st1 - tr59: -//line parser.rl:20 + goto st2 + tr63: +//line parser.rl:93 - tok = p + event.SetTimeZone(data[tok:p]) goto st42 st42: @@ -1000,906 +1277,1259 @@ func Parse(data []byte, event *event) { goto _test_eof42 } st_case_42: -//line parser.go:991 - if data[(p)] == 62 { - goto tr61 +//line parser.go:1250 + if data[(p)] == 32 { + goto st22 } - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st43 + switch { + case data[(p)] > 13: + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st39 + } + case data[(p)] >= 9: + goto st22 } - goto st1 + goto st2 + tr36: +//line parser.rl:58 + + event.SetSecond(data[tok:p]) + + goto st43 st43: if (p)++; (p) == (pe) { goto _test_eof43 } st_case_43: - if data[(p)] == 62 { - goto tr61 - } +//line parser.go:1274 if 48 <= data[(p)] && data[(p)] <= 57 { - goto st44 + goto tr67 } - goto st1 + goto st2 + tr67: +//line parser.rl:22 + + tok = p + + goto st44 st44: if (p)++; (p) == (pe) { goto _test_eof44 } st_case_44: - if data[(p)] == 62 { - goto tr61 +//line parser.go:1290 + switch data[(p)] { + case 32: + goto tr68 + case 43: + goto tr69 + case 45: + goto tr69 + case 58: + goto tr71 + case 90: + goto tr72 + case 122: + goto tr72 } - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st45 + switch { + case data[(p)] > 13: + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st44 + } + case data[(p)] >= 9: + goto tr68 } - goto st1 + goto st2 + tr38: +//line parser.rl:58 + + event.SetSecond(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st45 + tr72: +//line parser.rl:62 + + event.SetNanosecond(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st45 st45: if (p)++; (p) == (pe) { goto _test_eof45 } st_case_45: - if data[(p)] == 62 { +//line parser.go:1339 + switch data[(p)] { + case 32: goto tr61 + case 43: + goto st36 + case 45: + goto st36 + case 58: + goto tr65 } - if 48 <= data[(p)] && data[(p)] <= 57 { - goto st46 + if 9 <= data[(p)] && data[(p)] <= 13 { + goto tr61 } - goto st1 + goto st2 + tr26: +//line parser.rl:22 + + tok = p + + goto st46 st46: if (p)++; (p) == (pe) { goto _test_eof46 } st_case_46: - if data[(p)] == 62 { - goto tr61 +//line parser.go:1365 + if 48 <= data[(p)] && data[(p)] <= 51 { + goto st15 + } + goto st2 + st47: + if (p)++; (p) == (pe) { + goto _test_eof47 + } + st_case_47: + if data[(p)] == 58 { + goto st48 + } + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st47 + } + goto st2 + st48: + if (p)++; (p) == (pe) { + goto _test_eof48 + } + st_case_48: + if data[(p)] == 32 { + goto tr74 } - goto st1 - tr61: -//line parser.rl:24 + if 9 <= data[(p)] && data[(p)] <= 13 { + goto tr74 + } + goto st2 + tr74: +//line parser.rl:22 - event.SetPriority(data[tok:p]) + tok = p - goto st47 - st47: + goto st49 + st49: if (p)++; (p) == (pe) { - goto _test_eof47 + goto _test_eof49 } - st_case_47: -//line parser.go:1055 + st_case_49: +//line parser.go:1405 switch data[(p)] { case 65: - goto tr3 + goto tr77 case 68: - goto tr4 + goto tr78 case 70: - goto tr5 + goto tr79 case 74: - goto tr6 + goto tr80 case 77: - goto tr7 + goto tr81 case 78: - goto tr8 + goto tr82 case 79: - goto tr9 + goto tr83 case 83: - goto tr10 + goto tr84 } if 48 <= data[(p)] && data[(p)] <= 57 { - goto tr1 + goto tr76 } - goto tr0 + goto tr75 + tr76: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st50 + st50: + if (p)++; (p) == (pe) { + goto _test_eof50 + } + st_case_50: +//line parser.go:1443 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st51 + } + goto st2 + st51: + if (p)++; (p) == (pe) { + goto _test_eof51 + } + st_case_51: + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st52 + } + goto st2 + st52: + if (p)++; (p) == (pe) { + goto _test_eof52 + } + st_case_52: + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st53 + } + goto st2 + st53: + if (p)++; (p) == (pe) { + goto _test_eof53 + } + st_case_53: + if data[(p)] == 45 { + goto tr17 + } + goto st2 tr3: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st48 - st48: + goto st54 + tr77: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st54 + st54: if (p)++; (p) == (pe) { - goto _test_eof48 + goto _test_eof54 } - st_case_48: -//line parser.go:1089 + st_case_54: +//line parser.go:1496 switch data[(p)] { case 112: - goto st49 + goto st55 case 117: - goto st70 + goto st76 } - goto st1 - st49: + goto st2 + st55: if (p)++; (p) == (pe) { - goto _test_eof49 + goto _test_eof55 } - st_case_49: + st_case_55: if data[(p)] == 114 { - goto st50 + goto st56 } - goto st1 - st50: + goto st2 + st56: if (p)++; (p) == (pe) { - goto _test_eof50 + goto _test_eof56 } - st_case_50: + st_case_56: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 105: - goto st68 + goto st74 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - tr68: -//line parser.rl:32 + goto st2 + tr91: +//line parser.rl:34 event.SetMonth(data[tok:p]) - goto st51 - st51: + goto st57 + st57: if (p)++; (p) == (pe) { - goto _test_eof51 + goto _test_eof57 } - st_case_51: -//line parser.go:1132 + st_case_57: +//line parser.go:1539 switch data[(p)] { case 32: - goto st52 + goto st58 case 51: - goto tr72 + goto tr95 } switch { case data[(p)] < 49: if 9 <= data[(p)] && data[(p)] <= 13 { - goto st52 + goto st58 } case data[(p)] > 50: if 52 <= data[(p)] && data[(p)] <= 57 { - goto tr73 + goto tr96 } default: - goto tr71 + goto tr94 } - goto st1 - st52: + goto st2 + st58: if (p)++; (p) == (pe) { - goto _test_eof52 + goto _test_eof58 } - st_case_52: + st_case_58: if 49 <= data[(p)] && data[(p)] <= 57 { - goto tr73 + goto tr96 } - goto st1 - tr73: -//line parser.rl:20 + goto st2 + tr96: +//line parser.rl:22 tok = p - goto st53 - st53: + goto st59 + st59: if (p)++; (p) == (pe) { - goto _test_eof53 + goto _test_eof59 } - st_case_53: -//line parser.go:1172 + st_case_59: +//line parser.go:1579 if data[(p)] == 32 { - goto tr74 + goto tr97 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr74 + goto tr97 } - goto st1 - tr74: -//line parser.rl:44 + goto st2 + tr97: +//line parser.rl:46 event.SetDay(data[tok:p]) - goto st54 - st54: + goto st60 + st60: if (p)++; (p) == (pe) { - goto _test_eof54 + goto _test_eof60 } - st_case_54: -//line parser.go:1191 + st_case_60: +//line parser.go:1598 if data[(p)] == 50 { - goto tr76 + goto tr99 } if 48 <= data[(p)] && data[(p)] <= 49 { - goto tr75 + goto tr98 } - goto st1 - tr75: -//line parser.rl:20 + goto st2 + tr98: +//line parser.rl:22 tok = p - goto st55 - st55: + goto st61 + st61: if (p)++; (p) == (pe) { - goto _test_eof55 + goto _test_eof61 } - st_case_55: -//line parser.go:1210 + st_case_61: +//line parser.go:1617 if 48 <= data[(p)] && data[(p)] <= 57 { - goto st56 + goto st62 } - goto st1 - st56: + goto st2 + st62: if (p)++; (p) == (pe) { - goto _test_eof56 + goto _test_eof62 } - st_case_56: + st_case_62: if data[(p)] == 58 { - goto tr78 + goto tr101 } - goto st1 - tr78: -//line parser.rl:48 + goto st2 + tr101: +//line parser.rl:50 event.SetHour(data[tok:p]) - goto st57 - st57: + goto st63 + st63: if (p)++; (p) == (pe) { - goto _test_eof57 + goto _test_eof63 } - st_case_57: -//line parser.go:1235 + st_case_63: +//line parser.go:1642 if 48 <= data[(p)] && data[(p)] <= 53 { - goto tr79 + goto tr102 } - goto st1 - tr79: -//line parser.rl:20 + goto st2 + tr102: +//line parser.rl:22 tok = p - goto st58 - st58: + goto st64 + st64: if (p)++; (p) == (pe) { - goto _test_eof58 + goto _test_eof64 } - st_case_58: -//line parser.go:1251 + st_case_64: +//line parser.go:1658 if 48 <= data[(p)] && data[(p)] <= 57 { - goto st59 + goto st65 } - goto st1 - st59: + goto st2 + st65: if (p)++; (p) == (pe) { - goto _test_eof59 + goto _test_eof65 } - st_case_59: + st_case_65: if data[(p)] == 58 { - goto tr81 + goto tr104 } - goto st1 - tr81: -//line parser.rl:52 + goto st2 + tr104: +//line parser.rl:54 event.SetMinute(data[tok:p]) - goto st60 - st60: + goto st66 + st66: if (p)++; (p) == (pe) { - goto _test_eof60 + goto _test_eof66 } - st_case_60: -//line parser.go:1276 + st_case_66: +//line parser.go:1683 if 48 <= data[(p)] && data[(p)] <= 53 { - goto tr82 + goto tr105 } - goto st1 - tr82: -//line parser.rl:20 + goto st2 + tr105: +//line parser.rl:22 tok = p - goto st61 - st61: + goto st67 + st67: if (p)++; (p) == (pe) { - goto _test_eof61 + goto _test_eof67 } - st_case_61: -//line parser.go:1292 + st_case_67: +//line parser.go:1699 if 48 <= data[(p)] && data[(p)] <= 57 { - goto st62 + goto st68 } - goto st1 - st62: + goto st2 + st68: if (p)++; (p) == (pe) { - goto _test_eof62 + goto _test_eof68 } - st_case_62: + st_case_68: switch data[(p)] { case 32: - goto tr31 + goto tr34 case 46: - goto tr84 + goto tr107 + case 58: + goto tr37 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr31 + goto tr34 } - goto st1 - tr84: -//line parser.rl:56 + goto st2 + tr107: +//line parser.rl:58 event.SetSecond(data[tok:p]) - goto st63 - st63: + goto st69 + st69: if (p)++; (p) == (pe) { - goto _test_eof63 + goto _test_eof69 } - st_case_63: -//line parser.go:1323 + st_case_69: +//line parser.go:1732 if 48 <= data[(p)] && data[(p)] <= 57 { - goto tr85 + goto tr108 } - goto st1 - tr85: -//line parser.rl:20 + goto st2 + tr108: +//line parser.rl:22 tok = p - goto st64 - st64: + goto st70 + st70: if (p)++; (p) == (pe) { - goto _test_eof64 + goto _test_eof70 } - st_case_64: -//line parser.go:1339 - if data[(p)] == 32 { - goto tr54 + st_case_70: +//line parser.go:1748 + switch data[(p)] { + case 32: + goto tr68 + case 58: + goto tr71 } switch { case data[(p)] > 13: if 48 <= data[(p)] && data[(p)] <= 57 { - goto st64 + goto st70 } case data[(p)] >= 9: - goto tr54 + goto tr68 } - goto st1 - tr76: -//line parser.rl:20 + goto st2 + tr99: +//line parser.rl:22 tok = p - goto st65 - st65: + goto st71 + st71: if (p)++; (p) == (pe) { - goto _test_eof65 + goto _test_eof71 } - st_case_65: -//line parser.go:1363 + st_case_71: +//line parser.go:1775 if 48 <= data[(p)] && data[(p)] <= 51 { - goto st56 + goto st62 } - goto st1 - tr71: -//line parser.rl:20 + goto st2 + tr94: +//line parser.rl:22 tok = p - goto st66 - st66: + goto st72 + st72: if (p)++; (p) == (pe) { - goto _test_eof66 + goto _test_eof72 } - st_case_66: -//line parser.go:1379 + st_case_72: +//line parser.go:1791 if data[(p)] == 32 { - goto tr74 + goto tr97 } switch { case data[(p)] > 13: if 48 <= data[(p)] && data[(p)] <= 57 { - goto st53 + goto st59 } case data[(p)] >= 9: - goto tr74 + goto tr97 } - goto st1 - tr72: -//line parser.rl:20 + goto st2 + tr95: +//line parser.rl:22 tok = p - goto st67 - st67: + goto st73 + st73: if (p)++; (p) == (pe) { - goto _test_eof67 + goto _test_eof73 } - st_case_67: -//line parser.go:1403 + st_case_73: +//line parser.go:1815 if data[(p)] == 32 { - goto tr74 + goto tr97 } switch { case data[(p)] > 13: if 48 <= data[(p)] && data[(p)] <= 49 { - goto st53 + goto st59 } case data[(p)] >= 9: - goto tr74 + goto tr97 } - goto st1 - st68: + goto st2 + st74: if (p)++; (p) == (pe) { - goto _test_eof68 + goto _test_eof74 } - st_case_68: + st_case_74: if data[(p)] == 108 { - goto st69 + goto st75 } - goto st1 - st69: + goto st2 + st75: if (p)++; (p) == (pe) { - goto _test_eof69 + goto _test_eof75 } - st_case_69: + st_case_75: if data[(p)] == 32 { - goto tr68 + goto tr91 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st70: + goto st2 + st76: if (p)++; (p) == (pe) { - goto _test_eof70 + goto _test_eof76 } - st_case_70: + st_case_76: if data[(p)] == 103 { - goto st71 + goto st77 } - goto st1 - st71: + goto st2 + st77: if (p)++; (p) == (pe) { - goto _test_eof71 + goto _test_eof77 } - st_case_71: + st_case_77: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 117: - goto st72 + goto st78 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st72: + goto st2 + st78: if (p)++; (p) == (pe) { - goto _test_eof72 + goto _test_eof78 } - st_case_72: + st_case_78: if data[(p)] == 115 { - goto st73 + goto st79 } - goto st1 - st73: + goto st2 + st79: if (p)++; (p) == (pe) { - goto _test_eof73 + goto _test_eof79 } - st_case_73: + st_case_79: if data[(p)] == 116 { - goto st69 + goto st75 } - goto st1 + goto st2 tr4: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st74 - st74: + goto st80 + tr78: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st80 + st80: if (p)++; (p) == (pe) { - goto _test_eof74 + goto _test_eof80 } - st_case_74: -//line parser.go:1490 + st_case_80: +//line parser.go:1912 if data[(p)] == 101 { - goto st75 + goto st81 } - goto st1 - st75: + goto st2 + st81: if (p)++; (p) == (pe) { - goto _test_eof75 + goto _test_eof81 } - st_case_75: + st_case_81: if data[(p)] == 99 { - goto st76 + goto st82 } - goto st1 - st76: + goto st2 + st82: if (p)++; (p) == (pe) { - goto _test_eof76 + goto _test_eof82 } - st_case_76: + st_case_82: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 101: - goto st77 + goto st83 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st77: + goto st2 + st83: if (p)++; (p) == (pe) { - goto _test_eof77 + goto _test_eof83 } - st_case_77: + st_case_83: if data[(p)] == 109 { - goto st78 + goto st84 } - goto st1 - st78: + goto st2 + st84: if (p)++; (p) == (pe) { - goto _test_eof78 + goto _test_eof84 } - st_case_78: + st_case_84: if data[(p)] == 98 { - goto st79 + goto st85 } - goto st1 - st79: + goto st2 + st85: if (p)++; (p) == (pe) { - goto _test_eof79 + goto _test_eof85 } - st_case_79: + st_case_85: if data[(p)] == 101 { - goto st80 + goto st86 } - goto st1 - st80: + goto st2 + st86: if (p)++; (p) == (pe) { - goto _test_eof80 + goto _test_eof86 } - st_case_80: + st_case_86: if data[(p)] == 114 { - goto st69 + goto st75 } - goto st1 + goto st2 tr5: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st81 - st81: + goto st87 + tr79: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st87 + st87: if (p)++; (p) == (pe) { - goto _test_eof81 + goto _test_eof87 } - st_case_81: -//line parser.go:1566 + st_case_87: +//line parser.go:1998 if data[(p)] == 101 { - goto st82 + goto st88 } - goto st1 - st82: + goto st2 + st88: if (p)++; (p) == (pe) { - goto _test_eof82 + goto _test_eof88 } - st_case_82: + st_case_88: if data[(p)] == 98 { - goto st83 + goto st89 } - goto st1 - st83: + goto st2 + st89: if (p)++; (p) == (pe) { - goto _test_eof83 + goto _test_eof89 } - st_case_83: + st_case_89: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 114: - goto st84 + goto st90 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st84: + goto st2 + st90: if (p)++; (p) == (pe) { - goto _test_eof84 + goto _test_eof90 } - st_case_84: + st_case_90: if data[(p)] == 117 { - goto st85 + goto st91 } - goto st1 - st85: + goto st2 + st91: if (p)++; (p) == (pe) { - goto _test_eof85 + goto _test_eof91 } - st_case_85: + st_case_91: if data[(p)] == 97 { - goto st86 + goto st92 } - goto st1 - st86: + goto st2 + st92: if (p)++; (p) == (pe) { - goto _test_eof86 + goto _test_eof92 } - st_case_86: + st_case_92: if data[(p)] == 114 { - goto st87 + goto st93 } - goto st1 - st87: + goto st2 + st93: if (p)++; (p) == (pe) { - goto _test_eof87 + goto _test_eof93 } - st_case_87: + st_case_93: if data[(p)] == 121 { - goto st69 + goto st75 } - goto st1 + goto st2 tr6: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st88 - st88: + goto st94 + tr80: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st94 + st94: if (p)++; (p) == (pe) { - goto _test_eof88 + goto _test_eof94 } - st_case_88: -//line parser.go:1642 + st_case_94: +//line parser.go:2084 switch data[(p)] { case 97: - goto st89 + goto st95 case 117: - goto st91 + goto st97 } - goto st1 - st89: + goto st2 + st95: if (p)++; (p) == (pe) { - goto _test_eof89 + goto _test_eof95 } - st_case_89: + st_case_95: if data[(p)] == 110 { - goto st90 + goto st96 } - goto st1 - st90: + goto st2 + st96: if (p)++; (p) == (pe) { - goto _test_eof90 + goto _test_eof96 } - st_case_90: + st_case_96: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 117: - goto st85 + goto st91 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st91: + goto st2 + st97: if (p)++; (p) == (pe) { - goto _test_eof91 + goto _test_eof97 } - st_case_91: + st_case_97: switch data[(p)] { case 108: - goto st92 + goto st98 case 110: - goto st93 + goto st99 } - goto st1 - st92: + goto st2 + st98: if (p)++; (p) == (pe) { - goto _test_eof92 + goto _test_eof98 } - st_case_92: + st_case_98: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 121: - goto st69 + goto st75 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st93: + goto st2 + st99: if (p)++; (p) == (pe) { - goto _test_eof93 + goto _test_eof99 } - st_case_93: + st_case_99: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 101: - goto st69 + goto st75 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 + goto st2 tr7: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st94 - st94: + goto st100 + tr81: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st100 + st100: if (p)++; (p) == (pe) { - goto _test_eof94 + goto _test_eof100 } - st_case_94: -//line parser.go:1727 + st_case_100: +//line parser.go:2179 if data[(p)] == 97 { - goto st95 + goto st101 } - goto st1 - st95: + goto st2 + st101: if (p)++; (p) == (pe) { - goto _test_eof95 + goto _test_eof101 } - st_case_95: + st_case_101: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 114: - goto st96 + goto st102 case 121: - goto st69 + goto st75 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st96: + goto st2 + st102: if (p)++; (p) == (pe) { - goto _test_eof96 + goto _test_eof102 } - st_case_96: + st_case_102: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 99: - goto st97 + goto st103 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st97: + goto st2 + st103: if (p)++; (p) == (pe) { - goto _test_eof97 + goto _test_eof103 } - st_case_97: + st_case_103: if data[(p)] == 104 { - goto st69 + goto st75 } - goto st1 + goto st2 tr8: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st98 - st98: + goto st104 + tr82: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st104 + st104: if (p)++; (p) == (pe) { - goto _test_eof98 + goto _test_eof104 } - st_case_98: -//line parser.go:1784 + st_case_104: +//line parser.go:2246 if data[(p)] == 111 { - goto st99 + goto st105 } - goto st1 - st99: + goto st2 + st105: if (p)++; (p) == (pe) { - goto _test_eof99 + goto _test_eof105 } - st_case_99: + st_case_105: if data[(p)] == 118 { - goto st76 + goto st82 } - goto st1 + goto st2 tr9: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st100 - st100: + goto st106 + tr83: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st106 + st106: if (p)++; (p) == (pe) { - goto _test_eof100 + goto _test_eof106 } - st_case_100: -//line parser.go:1809 + st_case_106: +//line parser.go:2281 if data[(p)] == 99 { - goto st101 + goto st107 } - goto st1 - st101: + goto st2 + st107: if (p)++; (p) == (pe) { - goto _test_eof101 + goto _test_eof107 } - st_case_101: + st_case_107: if data[(p)] == 116 { - goto st102 + goto st108 } - goto st1 - st102: + goto st2 + st108: if (p)++; (p) == (pe) { - goto _test_eof102 + goto _test_eof108 } - st_case_102: + st_case_108: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 111: - goto st78 + goto st84 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 + goto st2 tr10: -//line parser.rl:20 +//line parser.rl:22 tok = p - goto st103 - st103: + goto st109 + tr84: +//line parser.rl:97 + + event.SetSequence(data[tok:p]) + +//line parser.rl:22 + + tok = p + + goto st109 + st109: if (p)++; (p) == (pe) { - goto _test_eof103 + goto _test_eof109 } - st_case_103: -//line parser.go:1849 + st_case_109: +//line parser.go:2331 if data[(p)] == 101 { - goto st104 + goto st110 } - goto st1 - st104: + goto st2 + st110: if (p)++; (p) == (pe) { - goto _test_eof104 + goto _test_eof110 } - st_case_104: + st_case_110: if data[(p)] == 112 { - goto st105 + goto st111 } - goto st1 - st105: + goto st2 + st111: if (p)++; (p) == (pe) { - goto _test_eof105 + goto _test_eof111 } - st_case_105: + st_case_111: switch data[(p)] { case 32: - goto tr68 + goto tr91 case 116: - goto st106 + goto st112 } if 9 <= data[(p)] && data[(p)] <= 13 { - goto tr68 + goto tr91 } - goto st1 - st106: + goto st2 + st112: if (p)++; (p) == (pe) { - goto _test_eof106 + goto _test_eof112 } - st_case_106: + st_case_112: if data[(p)] == 101 { - goto st77 + goto st83 + } + goto st2 + tr2: +//line parser.rl:22 + + tok = p + + goto st113 + st113: + if (p)++; (p) == (pe) { + goto _test_eof113 + } + st_case_113: +//line parser.go:2380 + if 48 <= data[(p)] && data[(p)] <= 57 { + goto tr141 + } + goto st2 + tr141: +//line parser.rl:22 + + tok = p + + goto st114 + st114: + if (p)++; (p) == (pe) { + goto _test_eof114 + } + st_case_114: +//line parser.go:2396 + if data[(p)] == 62 { + goto tr143 + } + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st115 + } + goto st2 + st115: + if (p)++; (p) == (pe) { + goto _test_eof115 + } + st_case_115: + if data[(p)] == 62 { + goto tr143 + } + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st116 + } + goto st2 + st116: + if (p)++; (p) == (pe) { + goto _test_eof116 + } + st_case_116: + if data[(p)] == 62 { + goto tr143 + } + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st117 + } + goto st2 + st117: + if (p)++; (p) == (pe) { + goto _test_eof117 + } + st_case_117: + if data[(p)] == 62 { + goto tr143 + } + if 48 <= data[(p)] && data[(p)] <= 57 { + goto st118 + } + goto st2 + st118: + if (p)++; (p) == (pe) { + goto _test_eof118 + } + st_case_118: + if data[(p)] == 62 { + goto tr143 + } + goto st2 + tr143: +//line parser.rl:26 + + event.SetPriority(data[tok:p]) + + goto st119 + st119: + if (p)++; (p) == (pe) { + goto _test_eof119 + } + st_case_119: +//line parser.go:2460 + switch data[(p)] { + case 65: + goto tr3 + case 68: + goto tr4 + case 70: + goto tr5 + case 74: + goto tr6 + case 77: + goto tr7 + case 78: + goto tr8 + case 79: + goto tr9 + case 83: + goto tr10 + } + if 48 <= data[(p)] && data[(p)] <= 57 { + goto tr1 + } + goto tr0 + st1: + if (p)++; (p) == (pe) { + goto _test_eof1 + } + st_case_1: + goto tr11 + tr11: +//line parser.rl:22 + + tok = p + + goto st120 + st120: + if (p)++; (p) == (pe) { + goto _test_eof120 } - goto st1 + st_case_120: +//line parser.go:2500 + goto st120 st_out: - _test_eof1: - cs = 1 - goto _test_eof _test_eof2: cs = 2 goto _test_eof @@ -2215,23 +2845,68 @@ func Parse(data []byte, event *event) { _test_eof106: cs = 106 goto _test_eof + _test_eof107: + cs = 107 + goto _test_eof + _test_eof108: + cs = 108 + goto _test_eof + _test_eof109: + cs = 109 + goto _test_eof + _test_eof110: + cs = 110 + goto _test_eof + _test_eof111: + cs = 111 + goto _test_eof + _test_eof112: + cs = 112 + goto _test_eof + _test_eof113: + cs = 113 + goto _test_eof + _test_eof114: + cs = 114 + goto _test_eof + _test_eof115: + cs = 115 + goto _test_eof + _test_eof116: + cs = 116 + goto _test_eof + _test_eof117: + cs = 117 + goto _test_eof + _test_eof118: + cs = 118 + goto _test_eof + _test_eof119: + cs = 119 + goto _test_eof + _test_eof1: + cs = 1 + goto _test_eof + _test_eof120: + cs = 120 + goto _test_eof _test_eof: { } if (p) == eof { switch cs { - case 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106: -//line parser.rl:28 + case 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120: +//line parser.rl:30 event.SetMessage(data[tok:p]) -//line parser.go:2003 +//line parser.go:2632 } } } -//line parser.rl:84 +//line parser.rl:105 } diff --git a/filebeat/input/syslog/parser.rl b/filebeat/input/syslog/parser.rl index cbfd32362aec..e5b2c1b143fe 100644 --- a/filebeat/input/syslog/parser.rl +++ b/filebeat/input/syslog/parser.rl @@ -8,9 +8,11 @@ package syslog variable pe pe; }%% -// syslog -//<34>Oct 11 22:14:15 wopr su: 'su root' failed for foobar -//<13>Feb 5 17:32:18 10.0.0.99 Use the quad dmg. +var ( + noDuplicates = []byte{'-', '.'} +) + +// Parse parses Syslog events. func Parse(data []byte, event *event) { var p, cs int pe := len(data) @@ -61,6 +63,21 @@ func Parse(data []byte, event *event) { event.SetNanosecond(data[tok:p]) } + # NOTES: This allow to bail out of obvious non valid + # hostname, this might not be ideal in all situation, but + # when this happen we just go to the catch all case and at least + # extract the message + action lookahead_duplicates{ + if p-1 > 0 { + for _, b := range noDuplicates { + if data[p] == b && data[p-1] == b { + p = tok -1 + fgoto catch_all; + } + } + } + } + action hostname { event.SetHostname(data[tok:p]) } @@ -77,6 +94,10 @@ func Parse(data []byte, event *event) { event.SetTimeZone(data[tok:p]) } + action sequence { + event.SetSequence(data[tok:p]) + } + include syslog_rfc3164 "syslog_rfc3164.rl"; write init; diff --git a/filebeat/input/syslog/parser_test.go b/filebeat/input/syslog/parser_test.go index 68abc2e3f129..161cc3779dfc 100644 --- a/filebeat/input/syslog/parser_test.go +++ b/filebeat/input/syslog/parser_test.go @@ -31,6 +31,25 @@ func TestParseSyslog(t *testing.T) { log []byte syslog event }{ + { + title: "Cisco's syslog", + log: []byte("<190>589265: Feb 8 18:55:31.306: %SEC-11-IPACCESSLOGP: list 177 denied udp 10.0.0.1(53640) -> 10.100.0.1(15600), 1 packet"), + syslog: event{ + priority: 190, + message: "%SEC-11-IPACCESSLOGP: list 177 denied udp 10.0.0.1(53640) -> 10.100.0.1(15600), 1 packet", + hostname: "", + program: "", + pid: -1, + month: 2, + day: 8, + year: 2018, + hour: 18, + minute: 55, + second: 31, + nanosecond: 306000000, + sequence: 589265, + }, + }, { title: "no timezone in date", log: []byte("<190>2018-06-19 02:13:38 super mon message"), @@ -507,6 +526,96 @@ func TestParseSyslog(t *testing.T) { second: 18, }, }, + { + title: "ipv6: 1::", + log: []byte("<13>Feb 25 17:32:18 1:: Use the Force!"), + syslog: event{ + message: "Use the Force!", + hostname: "1::", + priority: 13, + pid: -1, + month: 2, + day: 25, + hour: 17, + minute: 32, + second: 18, + }, + }, + { + title: "ipv6: 1::2", + log: []byte("<13>Feb 25 17:32:18 1::2 Use the Force!"), + syslog: event{ + message: "Use the Force!", + hostname: "1::2", + priority: 13, + pid: -1, + month: 2, + day: 25, + hour: 17, + minute: 32, + second: 18, + }, + }, + { + title: "ipv6: 1::2:5", + log: []byte("<13>Feb 25 17:32:18 1::2:5 Use the Force!"), + syslog: event{ + message: "Use the Force!", + hostname: "1::2:5", + priority: 13, + pid: -1, + month: 2, + day: 25, + hour: 17, + minute: 32, + second: 18, + }, + }, + { + title: "ipv4 mapped on ipv6", + log: []byte("<13>Feb 25 17:32:18 ::ffff:0:255.255.255.255 Use the Force!"), + syslog: event{ + message: "Use the Force!", + hostname: "::ffff:0:255.255.255.255", + priority: 13, + pid: -1, + month: 2, + day: 25, + hour: 17, + minute: 32, + second: 18, + }, + }, + { + title: "ipv4 embedded on ipv6", + log: []byte("<13>Feb 25 17:32:18 60::ffff::10.0.1.120 Use the Force!"), + syslog: event{ + message: "Use the Force!", + hostname: "60::ffff::10.0.1.120", + priority: 13, + pid: -1, + month: 2, + day: 25, + hour: 17, + minute: 32, + second: 18, + }, + }, + { + title: "ipv6: 1:2:3:4:5:6:7:8", + log: []byte("<13>Feb 25 17:32:18 1:2:3:4:5:6:7:8 Use the Force!"), + syslog: event{ + message: "Use the Force!", + hostname: "1:2:3:4:5:6:7:8", + priority: 13, + pid: -1, + month: 2, + day: 25, + hour: 17, + minute: 32, + second: 18, + }, + }, { title: "Number inf the host", log: []byte("<164>Oct 26 15:19:25 1.2.3.4 ASA1-2: Deny udp src DRAC:10.1.2.3/43434 dst outside:192.168.0.1/53 by access-group \"acl_drac\" [0x0, 0x0]"), diff --git a/filebeat/input/syslog/syslog_rfc3164.rl b/filebeat/input/syslog/syslog_rfc3164.rl index 2a5638f29a03..e16b9da35da4 100644 --- a/filebeat/input/syslog/syslog_rfc3164.rl +++ b/filebeat/input/syslog/syslog_rfc3164.rl @@ -42,10 +42,11 @@ timestamp_rfc3164 = month space day space time; time_separator = "T" | "t"; timestamp_rfc3339 = year "-" month_numeric "-" day_two_digits (time_separator | space) time timezone?; - timestamp = timestamp_rfc3339 | timestamp_rfc3164; + timestamp = (timestamp_rfc3339 | timestamp_rfc3164) ":"?; - hostname = [a-zA-Z0-9.-_:]+>tok %hostname; - header = timestamp space hostname space; + hostname = ([a-zA-Z0-9\.\-_:]*([a-zA-Z0-9] | "::"))+>tok $lookahead_duplicates %hostname; + hostVars = (hostname ":") | hostname; + header = timestamp space hostVars ":"? space; # MSG # https://tools.ietf.org/html/rfc3164#section-4.1.3 @@ -54,7 +55,9 @@ syslogprog = program ("[" pid "]")? ":" space; message = any+>tok %message; msg = syslogprog? message>tok %message; + sequence = digit+ ":" space>tok %sequence; - main := (prio)? (header msg | timestamp space message | message); + main := (prio)?(sequence)? (header msg | timestamp space message | message); + catch_all := message; }%%