# Parser: no_year
# ===============
# the given format don't contain the Year, this is a common
# case on old Syslog implementations.
#
[PARSER]
    Name        no_year
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S
    Time_Keep   On

# Parser: no_year_N
# =================
# Just for compatibility, check a string with no year but including Nanoseconds.
#
[PARSER]
    Name        no_year_N
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S.%L
    Time_Keep   On

# Parser: no_year_NC
# =================
# Just for compatibility, check a string with no year but including Nanoseconds with comma as fractional separator.
#
[PARSER]
    Name        no_year_NC
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S,%L
    Time_Keep   On

# Parser: no_year_TZ
# =================
# Time string with no year and including timezone
#
[PARSER]
    Name        no_year_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S %z
    Time_Keep   On

# Parser: no_year_N_TZ
# ====================
# Time string with no year, nanoseconds and timezone
#
[PARSER]
    Name        no_year_N_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S.%L %z
    Time_Keep   On


# Parser: no_year_NC_TZ
# ====================
# Time string with no year, nanoseconds and timezone with comma as fractional separator.
#
[PARSER]
    Name        no_year_NC_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S,%L %z
    Time_Keep   On


# Parser: default_UTC
# ===================
# Time string with timezone in UTC
#
[PARSER]
    Name        default_UTC
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S
    Time_Keep   On

# Parser: default_UTC_Z
# =====================
# Time string with timezone in UTC and ending Z
#
[PARSER]
    Name        default_UTC_Z
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%SZ
    Time_Keep   On

# Parser: default_UTC_N_Z
# =======================
# Time string with timezone in UTC, nanoseconds and ending Z
#
[PARSER]
    Name        default_UTC_N_Z
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S.%LZ
    Time_Keep   On

# Parser: default_UTC_NC_Z
# =======================
# Time string with timezone in UTC, nanoseconds with comma as fractional separator and ending Z
#
[PARSER]
    Name        default_UTC_NC_Z
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S,%LZ
    Time_Keep   On

# Parser: generic_TZ
# ==================
# Generic date with timezone
#
[PARSER]
    Name        generic_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S %z
    Time_Keep   On

# Parser: generic
# ===============
# Generic date
#
[PARSER]
    Name        generic
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S
    Time_Keep   On

# Parser: generic_N
# ===============
# Generic date with nanoseconds
#
[PARSER]
    Name        generic_N
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S.%L
    Time_Keep   On

# Parser: generic_NC
# ===============
# Generic date with nanoseconds with comma as fractional separator
#
[PARSER]
    Name        generic_NC
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S,%L
    Time_Keep   On

# Parser: generic_N_TZ
# ====================
# Generic date with nanoseconds and timezone
#
[PARSER]
    Name        generic_N_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S.%L %z
    Time_Keep   On

# Parser: generic_NC_TZ
# ====================
# Generic date with nanoseconds with comma as fractional separator and timezone
#
[PARSER]
    Name        generic_NC_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S,%L %z
    Time_Keep   On

# Parser: generic_NL_TZ
# ====================
# Generic date with nanoseconds with colon as fractional separator and timezone
#
[PARSER]
    Name        generic_NL_TZ
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %m/%d/%Y %H:%M:%S:%L %z
    Time_Keep   On


# Parser: apache_error
# ====================
# Apache error log time format
#
[PARSER]
    Name        apache_error
    Format      regex
    Regex       ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$
    Time_Key    time
    Time_Format %a %b %d %H:%M:%S.%L %Y
    Time_Keep   On



# Parser: mysql_quoted_stuff
# ====================
# Apache error log time format
#
[PARSER]
    Name        mysql_quoted_stuff
    Format      regex
    Regex       ^(?<time>.*?),(?<key001>.*)$
    Time_Key    time
    Time_Format %Y-%M-%S %H:%M:%S
    Time_Keep   On
    Decode_Field_As   mysql_quoted key001