Snapshot 95 demo-tenant parsers (incl. stormshield) + un-ignore parsers/

The original upstream gitignores parsers/* on the assumption that each tenant
has its own set. This fork commits a working snapshot so the Parser Test Runner
and Parser Coverage features are usable out of the box.

Stormshield parser exercises the new SDL key=value scanner, pattern references,
and JS-style unquoted format keys added to backend/routers/quality.py.
This commit is contained in:
marc
2026-05-22 14:11:39 +02:00
parent 1e61fa9814
commit a9dcf48e65
96 changed files with 14742 additions and 5 deletions
+19
View File
@@ -0,0 +1,19 @@
{
// specify a time zone if the timestamps in your log are not in GMT
// timezone: "GMT-0800"
formats: [
{
id: "format1",
format: ".*$=json{parse=dottedJson}$"
rewrites: [
{input: "TimestampConnectionEnd", output: "timestamp", match: ".*", replace: "$0"}
// moved upstread wher it is more efficient
{input: "message", output: "message", match: "(.*\")(\\{\"\\w+\".*)", replace: "$2"}
]
}
]
}