pC_postgresqlpcsvdatabaseloginsuccessauthentication.md

Parser Content

{
Name = postgresql-p-csv-database-login-success-authentication
  Vendor = PostgreSQL
  Product = PostgreSQL
  TimeFormat = ["yyyy-MM-dd HH:mm:ss.SSS","yyyy-MM-dd HH:mm:ss"]
  Conditions = [ """connection authorized:""", """ user=""", """ database=""", """LOG""" ]
  Fields = [
    """\w+\s\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+({host}[\w\-\.]+)\spostgres"""
    """\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d.\d+Z\s+({host}[\w\-\.]+)\spostgres"""
    """({time}\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)\s*UTC"""
    """({time}\d{4}-\d{2}-\d{2}\s(\d{2}:){2}\d{2}\.\d{3,})\sUTC""",
    """({action}connection authorized)"""
    """connection authorized:\s*(\[[^\]]+\]:|({src_ip}((([0-9a-fA-F.]{0,4}):{1,2}){1,7}([0-9a-fA-F]){0,4})|(((25[0-5]|(2[0-4]|1\d|[0-9]|)\d)\.?\b){4}))(:({src_port}\d+))?)?"""
    """\s*user=({db_user}({user}[\w\.\-\!\#\^\~]{1,40}\$?))\s"""
    """({additional_info}(connection authorized).+?)\s*$"""
    """\sdatabase=({db_name}[^"\s=]+)"""
    """application_name=({app}[^\s]+)"""
    """database=({db_name}[\w\.\-]+)"""
    """:LOG:\s*({action}[^:]+)"""
    """<Computer>({dest_host}[\w\-.]+)<"""
  ]
  ParserVersion = "v1.0.0"


}