Enterprise Custom Decoders: Advanced Log Parsing for Complex Environments#

1
<!-- Decoder Architecture Overview -->
2
<decoder name="custom_app_root">
3
  <prematch>^CUSTOM-APP:</prematch>
4
  <plugin_decoder>JSON_Decoder</plugin_decoder>
5
</decoder>
6

7
<decoder name="custom_app_auth">
8
  <parent>custom_app_root</parent>
9
  <regex type="pcre2">
10
    "event_type":"(\w+)","user":"([^"]+)","ip":"([^"]+)",
11
    "result":"(\w+)","timestamp":"([^"]+)"
12
  </regex>
13
  <order>event_type, user, srcip, result, timestamp</order>
14
</decoder>
15

16
<decoder name="custom_app_transaction">
17
  <parent>custom_app_root</parent>
18
  <regex type="pcre2">
19
    "transaction_id":"([^"]+)","amount":([\d.]+),
20
    "currency":"(\w+)","status":"(\w+)"
21
  </regex>
22
  <order>transaction_id, amount, currency, status</order>
23
</decoder>

1
# Decoder Performance Analyzer
2
class DecoderOptimizer:
3
    def __init__(self):
4
        self.performance_metrics = {
5
            'regex_complexity': self.analyze_regex_complexity,
6
            'prematch_efficiency': self.analyze_prematch_efficiency,
7
            'hierarchy_depth': self.analyze_hierarchy_depth,
8
            'field_extraction': self.analyze_field_extraction
9
        }
10

11
    def optimize_decoder(self, decoder_xml):
12
        """Optimize decoder for performance"""
13
        optimization_report = {
14
            'original': decoder_xml,
15
            'optimizations': [],
16
            'performance_gain': 0
17
        }
18

19
        # Analyze current performance
20
        current_metrics = self.analyze_decoder(decoder_xml)
21

22
        # Optimize prematch
23
        if current_metrics['prematch_score'] < 0.8:
24
            optimized_prematch = self.optimize_prematch(decoder_xml)
25
            optimization_report['optimizations'].append({
26
                'type': 'prematch',
27
                'change': optimized_prematch
28
            })
29

30
        # Optimize regex
31
        if current_metrics['regex_efficiency'] < 0.7:
32
            optimized_regex = self.optimize_regex(decoder_xml)
33
            optimization_report['optimizations'].append({
34
                'type': 'regex',
35
                'change': optimized_regex
36
            })
37

38
        return optimization_report

1
<!-- Dynamic Log Parser with Multiple Format Support -->
2
<decoder name="dynamic_log_parser">
3
  <prematch>^\d{4}-\d{2}-\d{2}</prematch>
4
</decoder>
5

6
<!-- Format Variant 1: JSON Logs -->
7
<decoder name="dynamic_json">
8
  <parent>dynamic_log_parser</parent>
9
  <prematch>^[\d\-\s:]+\s*{</prematch>
10
  <plugin_decoder>JSON_Decoder</plugin_decoder>
11
  <use_own_name>yes</use_own_name>
12
</decoder>
13

14
<!-- Format Variant 2: Key-Value Pairs -->
15
<decoder name="dynamic_kv">
16
  <parent>dynamic_log_parser</parent>
17
  <regex type="pcre2">
18
    ^([\d\-\s:]+)\s+(\w+)=([^,]+),\s*(\w+)=([^,]+),
19
    \s*(\w+)=([^,]+)(?:,\s*(\w+)=([^,\s]+))?
20
  </regex>
21
  <order>timestamp, key1, value1, key2, value2, key3, value3, key4, value4</order>
22
</decoder>
23

24
<!-- Format Variant 3: Pipe-Delimited -->
25
<decoder name="dynamic_pipe">
26
  <parent>dynamic_log_parser</parent>
27
  <prematch>^[\d\-\s:]+\s*\|</prematch>
28
  <regex>^([\d\-\s:]+)\|([^|]+)\|([^|]+)\|([^|]+)\|([^|]+)</regex>
29
  <order>timestamp, event_id, user, action, result</order>
30
</decoder>

1
<!-- Multi-Line Java Exception Decoder -->
2
<decoder name="java_exception_start">
3
  <program_name>java_app</program_name>
4
  <prematch>^Exception in thread</prematch>
5
  <regex>^Exception in thread "(\S+)" (\S+): (.+)$</regex>
6
  <order>thread_name, exception_type, exception_message</order>
7
</decoder>
8

9
<decoder name="java_exception_stacktrace">
10
  <program_name>java_app</program_name>
11
  <prematch>^\s+at\s+</prematch>
12
  <regex>^\s+at\s+(\S+)\(([^:]+):(\d+)\)</regex>
13
  <order>method, file, line_number</order>
14
  <accumulate>yes</accumulate>
15
</decoder>
16

17
<!-- Multi-Line SQL Query Decoder -->
18
<decoder name="sql_query_multiline">
19
  <program_name>database</program_name>
20
  <prematch>^BEGIN QUERY:</prematch>
21
  <multiline_regex>
22
    ^BEGIN QUERY:\s*(\d+)\s*
23
    ((?:SELECT|INSERT|UPDATE|DELETE)[\s\S]+?)
24
    END QUERY:\s*\1
25
  </multiline_regex>
26
  <order>query_id, sql_statement</order>
27
</decoder>

1
# Advanced Nested Parser Implementation
2
class NestedLogParser:
3
    def __init__(self):
4
        self.parsers = {
5
            'xml': self.parse_xml_log,
6
            'json': self.parse_json_log,
7
            'protobuf': self.parse_protobuf_log,
8
            'custom': self.parse_custom_nested
9
        }
10

11
    def parse_custom_nested(self, log_line):
12
        """Parse complex nested custom format"""
13
        # Example: [HEADER{key1:value1,key2:{subkey1:subvalue1}}]DATA[array1,array2]
14

15
        parsed = {
16
            'header': {},
17
            'data': [],
18
            'metadata': {}
19
        }
20

21
        # Extract header section
22
        header_match = re.search(r'\[HEADER({.+?})\]', log_line)
23
        if header_match:
24
            header_content = header_match.group(1)
25
            parsed['header'] = self.parse_nested_brackets(header_content)
26

27
        # Extract data section
28
        data_match = re.search(r'DATA\[([^\]]+)\]', log_line)
29
        if data_match:
30
            parsed['data'] = data_match.group(1).split(',')
31

32
        return parsed
33

34
    def parse_nested_brackets(self, content):
35
        """Recursively parse nested bracket structures"""
36
        result = {}
37

38
        # Handle nested structures
39
        depth = 0
40
        current_key = ''
41
        current_value = ''
42
        in_value = False
43

44
        for char in content:
45
            if char == '{':
46
                depth += 1
47
                if depth > 1:
48
                    current_value += char
49
            elif char == '}':
50
                depth -= 1
51
                if depth > 0:
52
                    current_value += char
53
                else:
54
                    # Complete current key-value pair
55
                    if current_key:
56
                        result[current_key] = self.parse_value(current_value)
57
            elif char == ':' and depth == 1:
58
                in_value = True
59
            elif char == ',' and depth == 1:
60
                if current_key:
61
                    result[current_key] = self.parse_value(current_value)
62
                current_key = ''
63
                current_value = ''
64
                in_value = False
65
            else:
66
                if in_value:
67
                    current_value += char
68
                else:
69
                    current_key += char
70

71
        return result

1
<!-- SAP Security Audit Log Decoder -->
2
<decoder name="sap_audit_root">
3
  <prematch>^SAP-AUDIT:</prematch>
4
</decoder>
5

6
<decoder name="sap_audit_detail">
7
  <parent>sap_audit_root</parent>
8
  <regex type="pcre2">
9
    ^SAP-AUDIT:\s*(\d{8})\s*(\d{6})\s*(\w+)\s*(\w+)\s*
10
    (\w+)\s*([^,]+),\s*(\w+),\s*(\d+),\s*(.+)$
11
  </regex>
12
  <order>date, time, client, user, transaction, terminal,
13
         return_code, message_number, message_text</order>
14
</decoder>
15

16
<!-- SAP RFC Call Decoder -->
17
<decoder name="sap_rfc">
18
  <parent>sap_audit_root</parent>
19
  <regex type="pcre2">
20
    RFC\s+CALL:\s*Function=(\w+)\s+User=(\w+)\s+
21
    Client=(\w+)\s+System=(\w+)\s+Return=(\w+)
22
  </regex>
23
  <order>function_module, user, client, system, return_code</order>
24
</decoder>

1
<!-- Oracle Alert Log Decoder -->
2
<decoder name="oracle_alert">
3
  <prematch>^ORA-\d{5}:</prematch>
4
  <regex>^(ORA-\d{5}):\s*(.+)$</regex>
5
  <order>error_code, error_message</order>
6
</decoder>
7

8
<!-- Oracle Audit Trail Decoder -->
9
<decoder name="oracle_audit">
10
  <prematch>^AUDIT:</prematch>
11
  <regex type="pcre2">
12
    ^AUDIT:\s*(\w+)\s+BY\s+(\w+)\s+AT\s+
13
    ([\d\-\s:]+)\s+FROM\s+([^\s]+)\s*
14
    (?:SESSIONID:\s*(\d+))?\s*(?:RETURNCODE:\s*(\d+))?
15
  </regex>
16
  <order>action, username, timestamp, host, session_id, return_code</order>
17
</decoder>
18

19
<!-- Oracle Performance Decoder -->
20
<decoder name="oracle_performance">
21
  <prematch>^PERF-METRIC:</prematch>
22
  <plugin_decoder>
23
    <name>custom_oracle_perf</name>
24
    <script>parse_oracle_performance.py</script>
25
  </plugin_decoder>
26
</decoder>

1
<!-- Kubernetes Event Decoder -->
2
<decoder name="k8s_event">
3
  <prematch>^K8S-EVENT:</prematch>
4
  <plugin_decoder>JSON_Decoder</plugin_decoder>
5
</decoder>
6

7
<!-- Kubernetes Audit Log Decoder -->
8
<decoder name="k8s_audit_root">
9
  <prematch>{"kind":"Event","apiVersion":"audit.k8s.io</prematch>
10
  <plugin_decoder>JSON_Decoder</plugin_decoder>
11
</decoder>
12

13
<decoder name="k8s_audit_detail">
14
  <parent>k8s_audit_root</parent>
15
  <use_own_name>yes</use_own_name>
16
  <regex type="pcre2">
17
    "verb":"(\w+)".*?"objectRef":\{"resource":"(\w+)",
18
    "namespace":"([^"]*)".*?"name":"([^"]*)".*?
19
    "user":\{"username":"([^"]*)"
20
  </regex>
21
  <order>verb, resource, namespace, resource_name, username</order>
22
</decoder>

1
class MLDecoderGenerator:
2
    def __init__(self):
3
        self.pattern_learner = PatternLearningModel()
4
        self.field_extractor = FieldExtractionModel()
5

6
    def generate_decoder(self, log_samples):
7
        """Generate decoder from log samples using ML"""
8
        # Learn log structure
9
        structure = self.pattern_learner.learn_structure(log_samples)
10

11
        # Identify fields
12
        fields = self.field_extractor.identify_fields(log_samples)
13

14
        # Generate decoder XML
15
        decoder_xml = self.build_decoder_xml(structure, fields)
16

17
        # Validate and optimize
18
        optimized_decoder = self.optimize_decoder(decoder_xml)
19

20
        return optimized_decoder
21

22
    def learn_structure(self, samples):
23
        """Learn common structure from samples"""
24
        # Tokenize samples
25
        tokenized = [self.tokenize(s) for s in samples]
26

27
        # Find common patterns
28
        common_tokens = self.find_common_tokens(tokenized)
29

30
        # Build regex pattern
31
        pattern = self.build_pattern(common_tokens)
32

33
        return {
34
            'pattern': pattern,
35
            'confidence': self.calculate_confidence(pattern, samples)
36
        }
37

38
    def identify_fields(self, samples):
39
        """Identify and classify fields"""
40
        fields = []
41

42
        # Extract potential fields
43
        for sample in samples:
44
            extracted = self.extract_values(sample)
45
            for value, context in extracted:
46
                field_type = self.classify_field(value, context)
47
                fields.append({
48
                    'value': value,
49
                    'type': field_type,
50
                    'context': context
51
                })
52

53
        # Consolidate and name fields
54
        consolidated_fields = self.consolidate_fields(fields)
55

56
        return consolidated_fields

1
class DecoderFactory:
2
    def __init__(self):
3
        self.templates = {
4
            'syslog': self.syslog_template,
5
            'json': self.json_template,
6
            'cef': self.cef_template,
7
            'leef': self.leef_template,
8
            'custom_kv': self.custom_kv_template
9
        }
10

11
    def create_decoder(self, name, log_format, fields):
12
        """Create decoder from template"""
13
        if log_format not in self.templates:
14
            raise ValueError(f"Unknown format: {log_format}")
15

16
        template = self.templates[log_format]
17
        decoder = template(name, fields)
18

19
        # Validate decoder
20
        self.validate_decoder(decoder)
21

22
        return decoder
23

24
    def custom_kv_template(self, name, fields):
25
        """Generate custom key-value decoder"""
26
        decoder = f"""
27
<decoder name="{name}_root">
28
  <prematch>^{fields.get('prematch', '\\w+:')}</prematch>
29
</decoder>
30

31
<decoder name="{name}_kv">
32
  <parent>{name}_root</parent>
33
  <regex type="pcre2">"""
34

35
        # Build regex for key-value pairs
36
        regex_parts = []
37
        order_parts = []
38

39
        for field in fields['fields']:
40
            key = field['key']
41
            value_pattern = field.get('pattern', '[^,]+')
42
            regex_parts.append(f"{key}=({value_pattern})")
43
            order_parts.append(field['name'])
44

45
        decoder += f"""
46
    ^{fields.get('prefix', '')}{'[,\\s]*'.join(regex_parts)}
47
  </regex>
48
  <order>{', '.join(order_parts)}</order>
49
</decoder>"""
50

51
        return decoder

1
class DecoderBenchmark:
2
    def __init__(self, wazuh_path='/var/ossec'):
3
        self.wazuh_path = wazuh_path
4
        self.logtest_binary = f"{wazuh_path}/bin/wazuh-logtest"
5

6
    def benchmark_decoder(self, decoder_file, log_samples, iterations=1000):
7
        """Benchmark decoder performance"""
8
        results = {
9
            'decoder': decoder_file,
10
            'samples': len(log_samples),
11
            'iterations': iterations,
12
            'metrics': {}
13
        }
14

15
        # Load decoder
16
        self.load_decoder(decoder_file)
17

18
        # Benchmark parsing speed
19
        start_time = time.time()
20
        successful_parses = 0
21

22
        for _ in range(iterations):
23
            for sample in log_samples:
24
                result = self.parse_log(sample)
25
                if result['decoded']:
26
                    successful_parses += 1
27

28
        elapsed_time = time.time() - start_time
29

30
        # Calculate metrics
31
        results['metrics'] = {
32
            'total_time': elapsed_time,
33
            'avg_time_per_log': elapsed_time / (iterations * len(log_samples)),
34
            'logs_per_second': (iterations * len(log_samples)) / elapsed_time,
35
            'success_rate': successful_parses / (iterations * len(log_samples)),
36
            'cpu_usage': self.measure_cpu_usage(),
37
            'memory_usage': self.measure_memory_usage()
38
        }
39

40
        return results
41

42
    def optimize_regex(self, regex_pattern):
43
        """Optimize regex for performance"""
44
        optimizations = []
45

46
        # Use atomic groups for better performance
47
        if '(?:' in regex_pattern and not '(?>':
48
            optimized = regex_pattern.replace('(?:', '(?>')
49
            optimizations.append({
50
                'type': 'atomic_groups',
51
                'original': regex_pattern,
52
                'optimized': optimized
53
            })
54

55
        # Use possessive quantifiers
56
        for quantifier in ['+', '*']:
57
            if f'){quantifier}' in regex_pattern:
58
                optimized = regex_pattern.replace(f'){quantifier}', f'){quantifier}+')
59
                optimizations.append({
60
                    'type': 'possessive_quantifiers',
61
                    'change': f'{quantifier} -> {quantifier}+'
62
                })
63

64
        return optimizations

1
<!-- Cached Decoder Configuration -->
2
<ossec_config>
3
  <global>
4
    <decoder_cache>
5
      <enabled>yes</enabled>
6
      <size>10000</size>
7
      <ttl>3600</ttl>
8
    </decoder_cache>
9
  </global>
10
</ossec_config>
11

12
<!-- High-Performance Decoder with Caching Hints -->
13
<decoder name="cached_app_decoder">
14
  <prematch>^APP-CACHED:</prematch>
15
  <cache_hint>frequent</cache_hint>
16
  <regex type="pcre2" flags="CASELESS|MULTILINE">
17
    ^APP-CACHED:\s*(\d+)\s*(\w+)\s*(.+)$
18
  </regex>
19
  <order>event_id, event_type, message</order>
20
</decoder>

1
class DecoderTester:
2
    def __init__(self):
3
        self.test_cases = []
4
        self.coverage_analyzer = CoverageAnalyzer()
5

6
    def add_test_case(self, log_line, expected_fields):
7
        """Add test case for decoder"""
8
        self.test_cases.append({
9
            'input': log_line,
10
            'expected': expected_fields,
11
            'test_id': hashlib.md5(log_line.encode()).hexdigest()[:8]
12
        })
13

14
    def run_tests(self, decoder_file):
15
        """Run comprehensive decoder tests"""
16
        results = {
17
            'decoder': decoder_file,
18
            'total_tests': len(self.test_cases),
19
            'passed': 0,
20
            'failed': 0,
21
            'coverage': 0,
22
            'failures': []
23
        }
24

25
        for test_case in self.test_cases:
26
            result = self.test_single_case(decoder_file, test_case)
27

28
            if result['passed']:
29
                results['passed'] += 1
30
            else:
31
                results['failed'] += 1
32
                results['failures'].append({
33
                    'test_id': test_case['test_id'],
34
                    'input': test_case['input'],
35
                    'expected': test_case['expected'],
36
                    'actual': result['actual'],
37
                    'error': result.get('error')
38
                })
39

40
        # Calculate coverage
41
        results['coverage'] = self.coverage_analyzer.calculate_coverage(
42
            decoder_file,
43
            self.test_cases
44
        )
45

46
        return results
47

48
    def generate_test_report(self, results):
49
        """Generate detailed test report"""
50
        report = f"""
51
# Decoder Test Report
52

53
## Summary
54
- Decoder: {results['decoder']}
55
- Total Tests: {results['total_tests']}
56
- Passed: {results['passed']} ({results['passed']/results['total_tests']*100:.1f}%)
57
- Failed: {results['failed']}
58
- Coverage: {results['coverage']:.1f}%
59

60
## Failed Tests
61
"""
62

63
        for failure in results['failures']:
64
            report += f"""
65
### Test {failure['test_id']}
66
- Input: `{failure['input']}`
67
- Expected: {failure['expected']}
68
- Actual: {failure['actual']}
69
- Error: {failure.get('error', 'Field mismatch')}
70
"""
71

72
        return report

1
def validate_decoder_syntax(decoder_xml):
2
    """Validate decoder XML syntax and best practices"""
3
    validation_results = {
4
        'syntax': True,
5
        'best_practices': [],
6
        'warnings': [],
7
        'errors': []
8
    }
9

10
    # Parse XML
11
    try:
12
        root = ET.fromstring(decoder_xml)
13
    except ET.ParseError as e:
14
        validation_results['syntax'] = False
15
        validation_results['errors'].append(f"XML Parse Error: {e}")
16
        return validation_results
17

18
    # Check for required elements
19
    if not root.find('prematch') and not root.find('parent'):
20
        validation_results['errors'].append(
21
            "Decoder must have either 'prematch' or 'parent'"
22
        )
23

24
    # Check regex complexity
25
    regex_elem = root.find('regex')
26
    if regex_elem is not None:
27
        regex_pattern = regex_elem.text
28
        complexity = calculate_regex_complexity(regex_pattern)
29
        if complexity > 100:
30
            validation_results['warnings'].append(
31
                f"High regex complexity ({complexity}). Consider simplifying."
32
            )
33

34
    # Check for naming conventions
35
    name = root.get('name')
36
    if name and not re.match(r'^[a-z][a-z0-9_]*$', name):
37
        validation_results['warnings'].append(
38
            "Decoder name should be lowercase with underscores"
39
        )
40

41
    return validation_results

1
#!/bin/bash
2
# Decoder deployment script
3

4
DECODER_DIR="/var/ossec/etc/decoders"
5
BACKUP_DIR="/var/ossec/etc/decoders/backup"
6
TEST_LOG="/tmp/decoder_test.log"
7

8
deploy_decoder() {
9
    local decoder_file=$1
10
    local decoder_name=$(basename "$decoder_file" .xml)
11

12
    echo "Deploying decoder: $decoder_name"
13

14
    # Backup existing decoder
15
    if [ -f "$DECODER_DIR/$decoder_name.xml" ]; then
16
        cp "$DECODER_DIR/$decoder_name.xml" \
17
           "$BACKUP_DIR/$decoder_name.xml.$(date +%Y%m%d%H%M%S)"
18
    fi
19

20
    # Validate decoder
21
    /var/ossec/bin/wazuh-logtest -v < "$TEST_LOG" > /tmp/validation.out 2>&1
22
    if [ $? -ne 0 ]; then
23
        echo "Decoder validation failed"
24
        cat /tmp/validation.out
25
        return 1
26
    fi
27

28
    # Deploy decoder
29
    cp "$decoder_file" "$DECODER_DIR/"
30

31
    # Set permissions
32
    chown ossec:ossec "$DECODER_DIR/$decoder_name.xml"
33
    chmod 640 "$DECODER_DIR/$decoder_name.xml"
34

35
    # Restart Wazuh manager
36
    systemctl restart wazuh-manager
37

38
    echo "Decoder deployed successfully"
39
}

1
class DecoderMonitor:
2
    def __init__(self, elasticsearch_client):
3
        self.es = elasticsearch_client
4
        self.metrics = {
5
            'parsing_failures': 0,
6
            'parsing_successes': 0,
7
            'avg_parsing_time': 0,
8
            'decoder_usage': defaultdict(int)
9
        }
10

11
    def monitor_decoder_performance(self, time_range='1h'):
12
        """Monitor decoder performance metrics"""
13
        # Query for decoder statistics
14
        query = {
15
            "query": {
16
                "range": {
17
                    "@timestamp": {
18
                        "gte": f"now-{time_range}"
19
                    }
20
                }
21
            },
22
            "aggs": {
23
                "decoder_stats": {
24
                    "terms": {
25
                        "field": "decoder.name",
26
                        "size": 100
27
                    },
28
                    "aggs": {
29
                        "avg_time": {
30
                            "avg": {
31
                                "field": "decoder.parsing_time"
32
                            }
33
                        },
34
                        "failure_rate": {
35
                            "filter": {
36
                                "term": {
37
                                    "decoder.status": "failed"
38
                                }
39
                            }
40
                        }
41
                    }
42
                }
43
            }
44
        }
45

46
        results = self.es.search(index="wazuh-monitoring-*", body=query)
47

48
        # Process results
49
        performance_report = []
50
        for bucket in results['aggregations']['decoder_stats']['buckets']:
51
            decoder_name = bucket['key']
52
            total_count = bucket['doc_count']
53
            avg_time = bucket['avg_time']['value']
54
            failures = bucket['failure_rate']['doc_count']
55

56
            performance_report.append({
57
                'decoder': decoder_name,
58
                'total_processed': total_count,
59
                'avg_parsing_time_ms': avg_time,
60
                'failure_rate': failures / total_count if total_count > 0 else 0,
61
                'recommendation': self.get_optimization_recommendation(
62
                    avg_time, failures / total_count if total_count > 0 else 0
63
                )
64
            })
65

66
        return performance_report

1
class DecoderDebugger:
2
    def __init__(self):
3
        self.debug_levels = {
4
            'basic': self.basic_debug,
5
            'regex': self.regex_debug,
6
            'performance': self.performance_debug,
7
            'full': self.full_debug
8
        }
9

10
    def debug_parsing_failure(self, decoder_file, log_line, debug_level='basic'):
11
        """Debug why a log line fails to parse"""
12
        debug_info = {
13
            'decoder': decoder_file,
14
            'log_line': log_line,
15
            'analysis': {}
16
        }
17

18
        # Run appropriate debug level
19
        debug_func = self.debug_levels.get(debug_level, self.basic_debug)
20
        debug_info['analysis'] = debug_func(decoder_file, log_line)
21

22
        return debug_info
23

24
    def regex_debug(self, decoder_file, log_line):
25
        """Debug regex matching issues"""
26
        # Load decoder
27
        decoder = self.load_decoder(decoder_file)
28

29
        # Test prematch
30
        prematch_result = self.test_prematch(decoder['prematch'], log_line)
31

32
        # Test main regex
33
        regex_result = self.test_regex(decoder['regex'], log_line)
34

35
        # Provide recommendations
36
        recommendations = []
37
        if not prematch_result['matched']:
38
            recommendations.append({
39
                'issue': 'Prematch failed',
40
                'suggestion': f"Adjust prematch pattern: {self.suggest_prematch(log_line)}"
41
            })
42

43
        if not regex_result['matched']:
44
            recommendations.append({
45
                'issue': 'Regex failed',
46
                'suggestion': 'Check regex pattern and escaping'
47
            })
48

49
        return {
50
            'prematch_test': prematch_result,
51
            'regex_test': regex_result,
52
            'recommendations': recommendations
53
        }

1
<!-- Conditional Decoder Based on Field Values -->
2
<decoder name="conditional_decoder">
3
  <prematch>^EVENT:</prematch>
4
  <regex>^EVENT:\s*(\w+)\s*(.+)$</regex>
5
  <order>event_type, event_data</order>
6
</decoder>
7

8
<!-- Type-specific decoders -->
9
<decoder name="conditional_auth">
10
  <parent>conditional_decoder</parent>
11
  <field name="event_type">AUTH</field>
12
  <regex offset="after_parent">^(\w+)\s+(\w+)\s+([^\s]+)\s+(\w+)$</regex>
13
  <order>action, user, source_ip, result</order>
14
</decoder>
15

16
<decoder name="conditional_file">
17
  <parent>conditional_decoder</parent>
18
  <field name="event_type">FILE</field>
19
  <regex offset="after_parent">^(\w+)\s+([^\s]+)\s+(\d+)\s+(\w+)$</regex>
20
  <order>operation, file_path, size, user</order>
21
</decoder>