From f8bf4e101bd6924a6e7db2cc46525f8e47b52c43 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Tue, 18 Nov 2025 11:51:27 -0700
Subject: [PATCH 01/19] config_format: Add parser*.yaml references alongside
 parser*.conf

Install parser*.yaml files alongside .conf and add commented-out
references to them in other configs.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 tests/internal/data/stream_processor/gen_msgpack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/internal/data/stream_processor/gen_msgpack.sh b/tests/internal/data/stream_processor/gen_msgpack.sh
index 19339318576..e354bfce1d0 100755
--- a/tests/internal/data/stream_processor/gen_msgpack.sh
+++ b/tests/internal/data/stream_processor/gen_msgpack.sh
@@ -7,7 +7,7 @@ echo
 rm -rf samples.mp samples-subkeys.mp
 
 # Generate new msgpack file using as a source samples.json
-../../../../build/bin/fluent-bit -R ../../../../conf/parsers.conf              \
+../../../../build/bin/fluent-bit -R ../../../../conf/parsers.yaml              \
  -i tail -t samples         -p path=samples.json          -p parser=json       \
  -i tail -t samples-subkeys -p path=samples-subkeys.json  -p parser=json       \
  -o file -m samples         -p format=msgpack  -p file=samples.mp              \
@@ -31,7 +31,7 @@ rm -rf samples.mp samples-subkeys.mp
      # Generate new msgpack files for hopping window
      echo ""
      echo "=== Generating MessagePack file for $file ... ==="
-     ../../../../build/bin/fluent-bit -R ../../../../conf/parsers.conf   \
+     ../../../../build/bin/fluent-bit -R ../../../../conf/parsers.yaml   \
       -i tail -p path=$file  -p parser=json                              \
       -o file -p format=msgpack -p file=$(echo $file | sed s/json/mp/) -f 1 &
       pid=$!

From c293b6eacddeb368e74ed08a5f749b0040712e93 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Tue, 18 Nov 2025 12:38:46 -0700
Subject: [PATCH 02/19] conf: prune old parser*.conf files that are no longer
 referenced

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parser_custom.conf      |  15 ---
 conf/parsers_ambassador.conf |   6 --
 conf/parsers_cinder.conf     |  10 --
 conf/parsers_extra.conf      | 172 -----------------------------------
 conf/parsers_java.conf       |   6 --
 conf/parsers_kafka.conf      |  16 ----
 conf/parsers_mult.conf       |  26 ------
 conf/parsers_openstack.conf  |  53 -----------
 8 files changed, 304 deletions(-)
 delete mode 100644 conf/parser_custom.conf
 delete mode 100644 conf/parsers_ambassador.conf
 delete mode 100644 conf/parsers_cinder.conf
 delete mode 100644 conf/parsers_extra.conf
 delete mode 100644 conf/parsers_java.conf
 delete mode 100644 conf/parsers_kafka.conf
 delete mode 100644 conf/parsers_mult.conf
 delete mode 100644 conf/parsers_openstack.conf

diff --git a/conf/parser_custom.conf b/conf/parser_custom.conf
deleted file mode 100644
index 63c439e085c..00000000000
--- a/conf/parser_custom.conf
+++ /dev/null
@@ -1,15 +0,0 @@
-[PARSER]
-      # https://rubular.com/r/6ZCuwV4Xa7nfA3
-      Name                rabbitmq
-      Format              regex
-      Regex               (?<date>[^ ]+)\s(?<time>[^ ]+)\s\[(?<log_level>[^ \]]*)\]\s(?<PID>[^ ]*)\s(?<msg>((([a-zA-Z]*\s+)+[^ ]*)+)+)
-[PARSER]
-      # https://rubular.com/r/jWfJIOMKr2LgcO
-      Name                neo4j
-      Format              regex
-      Regex               (?<date>[^ ]*) (?<time>[^ ]*) (?<log_level>[^ ]*)\s(?<msg>([^ ]*\s+[^ ]*)+)
-[PARSER]
-      # https://rubular.com/r/U8VbByp0oRPLU6
-      Name                external-dns
-      Format              regex
-      Regex               ([^ ])\"(?<time>[^ ]+)\"\s([^ ]+)\=(?<log_level>[.+a-zA-Z]+)\s([^ ]+)\"(?<msg>([^ ]*\s+[^ ]*\s[a-zA-Z0-9]*)+)
diff --git a/conf/parsers_ambassador.conf b/conf/parsers_ambassador.conf
deleted file mode 100644
index 3ab00d37b9b..00000000000
--- a/conf/parsers_ambassador.conf
+++ /dev/null
@@ -1,6 +0,0 @@
-# Ambassador - open source Kubernetes-native API gateway for microservices built on the Envoy Proxy https://www.getambassador.io
-
-[PARSER]
-    Name        ambassador
-    Format      regex
-    Regex       ^(?<type>\S+) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>(?:[^\"]|\\.)*?)(?: +\S*)?) (?<protocol>\S+)?" (?<response_code>\S+) (?<response_flags>\S+) (?<bytes_received>\S+) (?<bytes_sent>\S+) (?<duration>\S+) (?<x_envoy_upstream_service_time>\S+) "(?<x_forwarded_for>[^\"]*)" "(?<user_agent>[^\"]*)" "(?<x_request_id>[^\"]*)" "(?<authority>[^\"]*)" "(?<upstream_host>[^\"]*)"
diff --git a/conf/parsers_cinder.conf b/conf/parsers_cinder.conf
deleted file mode 100644
index 282ffdd6759..00000000000
--- a/conf/parsers_cinder.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-
-[PARSER]
-    # https://rubular.com/r/IvZVElTgNl
-    Name ceph
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep Off
-    Time_Key log_time
-
diff --git a/conf/parsers_extra.conf b/conf/parsers_extra.conf
deleted file mode 100644
index 3cca8faffba..00000000000
--- a/conf/parsers_extra.conf
+++ /dev/null
@@ -1,172 +0,0 @@
-# Extra set of common parsers
-
-[PARSER]
-    # https://rubular.com/r/cCVd1HLCAO
-    Name crowbar
-    Format regex
-    Regex ^.*\[(?<log_time>[^ ][-.\d\+:]+T[:\d]*)([^\]])*?\]\s+?(?<severity>[^ ]\w+)([\s-]*):?\s+(?<message>.*)
-    Time_Format %Y-%m-%dT%H:%M:%S
-    Time_Keep Off
-    Time_Key log_time
-
-[PARSER]
-    # https://rubular.com/r/frDgnElXW9 
-    Name chefclient
-    Format regex
-    Regex ^\[(?<log_time>[^ ][-.\d\+:]+T[:\d]*)([^\]])*?\]\s+(?<severity>[^ ]\w+):\s+(?<message>.*)$
-    Time_Format %Y-%m-%dT%H:%M:%S
-    Time_Keep Off
-    Time_Key log_time
-
-[PARSER]
-    Name mysql_error
-    Format regex
-    #Regex ^(?<log_time>[^ +][ -:0-9TZ]+|[[:upper:]][[:lower:]]{2})(\+\d+:\d+[TZ]*){0,1}\s*(?<myid>[^ ]\d+)\s+\[(?<severity>[^ ]\w+)\](\s+(?<subsystem>[^ ]\w+):){0,1}\s+(?<message>.*)$
-    Regex ^(?<log_time>[^ +][-\d]+[\ T]*[:\dZ]+)\s*(?<myid>[^ ]\d+)\s+\[(?<severity>[^ ]\w+)\](\s+(?<subsystem>[^ ]\w+):){0,1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name mysql_slow
-    Format regex
-    Regex ^# User\@Host:\s+(?<user>[^\@][\w\[\]]+)[@\s]+(?<dbhost>[^ ][-.\w]+)\s+(\[(?<dbhost_address>[.\d]+)\]){0,1}\s+(?<message>.*)$
-
-[PARSER]
-    Name pacemaker
-    Format regex
-    Regex ^\s*(?<log_time>[^ ]* {1,2}[^ ]* [^ ]*) \[(?<pid>\d+)\] (?<node>[\-\w]*)\s*(?<component>\w*):\s+(?<severity>\w+):\s+(?<message>.*)$
-    #Time_Format %Y-%m-%dT%H:%M:%S
-    Time_Format %b %d %H:%M:%S
-    Time_Keep   Off
-    Time_Key log_time
-    #Types pid:integer
-
-[PARSER]
-    Name rabbitmq
-    Format regex
-    Regex ^=(?<severity>[^ ]\w+)\s+REPORT[=\s]*(?<log_time>[^ =][-:.\d\w]+)[\s=]+(?<message>.*)$
-    Time_Format %d-%b-%Y::%H:%M:%S
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name http_statement
-    Format regex
-    Regex ^.*((?<req_method>GET|POST|PUT|DELETE|CONNECT|OPTIONS|HEAD[^ ]\w+)\s*(?<req_path>[^ ][-._?=%&\/[:alnum:]]*)\s*(?<req_protocol>[^ ][.\/\dHTFSP]+){0,1})(['"\s]*){0,1}((\s*status:\s*(?<req_status>[^ ]\d+)){0,1}(\s*len:\ (?<req_len>[^ ]\d+)){0,1}(\s*time:\s*(?<req_log_time>[^ ][.\d]+)){0,1}(\s*microversion:\s*(?<req_mver>[^ ][.\d]+)){0,1}){0,1}$
-
-[PARSER]
-    Name universal
-    Format regex
-    Regex ^(?<message>.*)$
-
-[PARSER]
-    Name uuid
-    Format regex
-    Regex (?<uuid>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})
-#UUID v1 :
-#/^[0-9A-F]{8}-[0-9A-F]{4}-[1][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
-#UUID v2 :
-#/^[0-9A-F]{8}-[0-9A-F]{4}-[2][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
-#UUID v3 :
-#/^[0-9A-F]{8}-[0-9A-F]{4}-[3][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
-#UUID v4 :
-#/^[0-9A-F]{8}-[0-9A-F]{4}-[4][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
-#UUID v5 :
-#/^[0-9A-F]{8}-[0-9A-F]{4}-[5][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
-
-# Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
-[PARSER]
-    Name iptables
-    Format regex
-    Regex \[(?<rule_chain>\w*)-(?<rule_name>\w*)-(?<accept_or_drop>\w*)\]IN=(?<in_interface>[\w.]+)? OUT=(?<out_interface>[\w.]+)? MAC=(?<mac_address>[\w:]+)? SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) LEN=(?<pkt_len>\d+) TOS=(?<pkt_tos>[\w\d]+) PREC=(?<pkt_prec>[\w\d]+) TTL=(?<pkt_ttl>\d+) ID=(?<pkt_id>\d+)\s?(?<pkg_frg>[A-Z\s].?)\s?PROTO=(?<protocol>[\w\d]+) (SPT=(?<source_port>.*) DPT=(?<dest_port>.*) (LEN=(?<proto_pkt_len>\w+)?)?(WINDOW=(?<proto_window_size>\d+) RES=(?<pkt_res>\w+)? (?<pkt_type>\w+)\s((?<pkt_flag>\w+)?)\s?URGP=(?<pkg_urgency>\d))? )?(TYPE=(?<pkt_icmp_type>\d+) CODE=(?<pkt_icmp_code>\d+) ID=(?<pkt_icmp_id>\d+) SEQ=(?<pkt_icmp_seq>\d+) )?$
-    Types source_port:integer,dest_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer
-
-# Various parsers for Couchbase Server logs
-
-[PARSER]
-    Name         couchbase_json_log_nanoseconds
-    Format       json
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%S.%L
-    Time_Keep    On 
-    # Do not remove the time field from the output we ship
-
-[PARSER]
-    Name         couchbase_rebalance_report
-    Format       json
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%SZ
-    Time_Keep    On 
-
-# The level may have optional brackets around it
-[PARSER]
-    Name         couchbase_simple_log
-    Format       regex
-    Regex        ^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+\[(?<level>\w+)\](?<message>.*)$
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%S.%L%z
-    Time_Keep    On
-
-[PARSER]
-    Name         couchbase_simple_log_space_separated
-    Format       regex
-    Regex        ^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+(?<level>\w+)\s+(?<message>.*)$
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%S.%L%z
-    Time_Keep    On
-
-# Slight change in time format to use Z at end instead of offset:
-# 2021-03-09T17:32:02.136Z INFO ...
-# https://rubular.com/r/EpG3M1dHb5AnTC
-[PARSER]
-    Name         couchbase_simple_log_utc
-    Format       regex
-    Regex        ^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+Z)\s+(?<level>\w+)(?<message>.*)$
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%S.%LZ
-    Time_Keep    On
-
-# Cope with two different log formats, e.g.:
-# 2021/03/09 17:32:15 cbauth: ...
-# 2021-03-09T17:32:15.303+00:00 [INFO] ...
-# https://rubular.com/r/XUt7xQqEJnrF2M
-[PARSER]
-    Name         couchbase_simple_log_mixed
-    Format       regex
-    Regex        ^(?<timestamp>\d+(-|/)\d+(-|/)\d+(T|\s+)\d+:\d+:\d+(\.\d+(\+|-)\d+:\d+|))\s+((\[)?(?<level>\w+)(\]|:))(?<message>.*)$
-    Time_Key     timestamp
-    Time_Keep    On
-# We cannot parse the time as different formats directly, it could be done downstream and/or left as current time
-
-[PARSER]
-    Name         couchbase_erlang_multiline
-    Format       regex
-    # For some reason this cannot parse an ending close bracket ] followed by a new line immediately
-    #Regex        \[(?<logger>\w+):(?<level>\w+),(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+.\d+Z),.*\](?<message>.*)$
-    Regex        \[(?<logger>\w+):(?<level>\w+),(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+.\d+Z),(?<message>.*)$
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%S.%L   
-    Time_Keep    On
-
-# 2021-03-09T17:32:25.339+00:00 INFO CBAS.bootstrap.AnalyticsNCApplication [main] ...
-# https://rubular.com/r/9jh1oKtXBN5GEV
-# Can include an exception stack trace or a thread dump as well but ignoring these for now
-[PARSER]
-    Name         couchbase_java_multiline
-    Format       regex
-    Regex        ^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+(?<level>\w+)\s+(?<class>.*)\s+\[(?<thread>.*)\]\s+(?<message>.*)$
-    Time_Key     timestamp
-    Time_Format  %Y-%m-%dT%H:%M:%S.%L%z
-    Time_Keep    On
-
-# A slight modification of the usual Apache/Apache2 parsers
-[PARSER]
-    Name         couchbase_http
-    Format       regex
-    Regex        ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<timestamp>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*) - (?<client>.*)$
-    Time_Key     timestamp
-    Time_Format %d/%b/%Y:%H:%M:%S %z
-    Time_Keep    On
-
-# End of Couchbase Server parsers
diff --git a/conf/parsers_java.conf b/conf/parsers_java.conf
deleted file mode 100644
index b03729a0c40..00000000000
--- a/conf/parsers_java.conf
+++ /dev/null
@@ -1,6 +0,0 @@
-[PARSER]
-    Name        java_multiline
-    Format      regex
-    Regex       /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)/
-    Time_Key    time
-    Time_Format %Y-%m-%d %H:%M:%S
diff --git a/conf/parsers_kafka.conf b/conf/parsers_kafka.conf
deleted file mode 100644
index db4384a616c..00000000000
--- a/conf/parsers_kafka.conf
+++ /dev/null
@@ -1,16 +0,0 @@
-[PARSER]
-    # Confluent Schema Registry 7.1.1 default format
-    Name confluent-schema-registry
-    Format regex
-    Time_Key time
-    Time_Format %Y-%m-%d %H:%M:%S,%L
-    Regex ^\[(?<time>\d{4}-\d{1,2}-\d{1,2} \d{2}:\d{2}:\d{2},\d{1,4})] (?<level>[A-Z]{1,8}) (?<src>[\d.]+) - - \[(?<date>.*)] \"(?<method>[A-Z]+) (?<path>\/[\S]+|\/) (?<http_version>HTTP\/[\d]\.[\d])\" (?<code>[\d]{1,3}) (?<size>[\d]+) \"-\" \"(?<agent>.*)\" (?<extra_info>.*)
-
-
-[PARSER]
-    # Confluent Schema Registry 7.1.1 default format - with _sr_ prefix to allow `nest`
-    Name confluent-schema-registry-prefixed
-    Format regex
-    Time_Key _sr_time
-    Time_Format %Y-%m-%d %H:%M:%S,%L
-    Regex ^\[(?<_sr_time>\d{4}-\d{1,2}-\d{1,2} \d{2}:\d{2}:\d{2},\d{1,4})] (?<_sr_level>[A-Z]{1,8}) (?<_sr_src>[\d.]+) - - \[(?<_sr_date>.*)] \"(?<_sr_method>[A-Z]+) (?<_sr_path>\/[\S]+|\/) (?<_sr_http_version>HTTP\/[\d]\.[\d])\" (?<_sr_code>[\d]{1,3}) (?<_sr_size>[\d]+) \"-\" \"(?<_sr_agent>.*)\" (?<_sr_extra_info>.*)
diff --git a/conf/parsers_mult.conf b/conf/parsers_mult.conf
deleted file mode 100644
index af9025f49dd..00000000000
--- a/conf/parsers_mult.conf
+++ /dev/null
@@ -1,26 +0,0 @@
-[PARSER]
-    Name        mult_first
-    Format      regex
-    Regex       Started (?<method>[^ ]+) "(?<path>[^"]+)" for (?<host>[^ ]+) at (?<time>[^ ]+ [^ ]+ [^ ]+)
-    Time_Key    time
-    Time_Format %Y-%m-%d %H:%M:%S %z
-
-[PARSER]
-    Name        mult_1
-    Format      regex
-    Regex       /Processing by (?<controller>[^\u0023]+)\u0023(?<controller_method>[^ ]+) as (?<format>[^ ]+?)$/
-
-[PARSER]
-    Name        mult_2
-    Format      regex
-    Regex       (  Parameters: (?<parameters>[^ ]+))?
-
-[PARSER]
-    Name        mult_3
-    Format      regex
-    Regex       /  Rendered (?<template>[^ ]+) within (?<layout>.+) \([\d\.]+ms\)/
-
-[PARSER]
-    Name        mult_4
-    Format      regex
-    Regex       Completed (?<code>[^ ]+) [^ ]+ in (?<runtime>[\d\.]+)ms \(Views: (?<view_runtime>[\d\.]+)ms \| ActiveRecord: (?<ar_runtime>[\d\.]+)ms\)
diff --git a/conf/parsers_openstack.conf b/conf/parsers_openstack.conf
deleted file mode 100644
index e1bbc803b82..00000000000
--- a/conf/parsers_openstack.conf
+++ /dev/null
@@ -1,53 +0,0 @@
-# Example openstack parsers, see source for recent updates:
-# https://github.com/salt-formulas/salt-formula-fluentbit/tree/master/metadata/service/config/parser
-
-# Take these parsers as an example, as they may not fully fit all possible
-# openstack deployments from all vendors, etc..
-
-[PARSER]
-    Name cinder
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name glance
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name heat
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name keystone
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name neutron
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep   Off
-    Time_Key log_time
-
-[PARSER]
-    Name nova
-    Format regex
-    Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$
-    Time_Format %Y-%m-%d %H:%M:%S.%L
-    Time_Keep   Off
-    Time_Key log_time

From 2b82251c43f4a816a69ab946f224edd00dba0f8f Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 14:14:30 -0700
Subject: [PATCH 03/19] conf: parser: standardize regex quoting in yaml configs

Single-quote regexes and do not use unnecessary / / delimeters.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parser_custom.yaml                                  | 6 +++---
 conf/parsers.yaml                                        | 8 ++++----
 conf/parsers_extra.yaml                                  | 4 ++--
 conf/parsers_java.yaml                                   | 2 +-
 conf/parsers_mult.yaml                                   | 6 +++---
 conf/parsers_multiline.yaml                              | 4 ++--
 tests/internal/data/config_format/yaml/extra_parser.yaml | 4 ++--
 7 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/conf/parser_custom.yaml b/conf/parser_custom.yaml
index 15af99427a2..a9c2a63032d 100644
--- a/conf/parser_custom.yaml
+++ b/conf/parser_custom.yaml
@@ -2,14 +2,14 @@ parsers:
   - name: rabbitmq
     # https://rubular.com/r/6ZCuwV4Xa7nfA3
     format: regex
-    regex: (?<date>[^ ]+)\s(?<time>[^ ]+)\s\[(?<log_level>[^ \]]*)\]\s(?<PID>[^ ]*)\s(?<msg>((([a-zA-Z]*\s+)+[^ ]*)+)+)
+    regex: '(?<date>[^ ]+)\s(?<time>[^ ]+)\s\[(?<log_level>[^ \]]*)\]\s(?<PID>[^ ]*)\s(?<msg>((([a-zA-Z]*\s+)+[^ ]*)+)+)'
 
   - name: neo4j
     # https://rubular.com/r/jWfJIOMKr2LgcO
     format: regex
-    regex: (?<date>[^ ]*) (?<time>[^ ]*) (?<log_level>[^ ]*)\s(?<msg>([^ ]*\s+[^ ]*)+)
+    regex: '(?<date>[^ ]*) (?<time>[^ ]*) (?<log_level>[^ ]*)\s(?<msg>([^ ]*\s+[^ ]*)+)'
 
   - name: external-dns
     # https://rubular.com/r/U8VbByp0oRPLU6
     format: regex
-    regex: ([^ ])\"(?<time>[^ ]+)\"\s([^ ]+)\=(?<log_level>[.+a-zA-Z]+)\s([^ ]+)\"(?<msg>([^ ]*\s+[^ ]*\s[a-zA-Z0-9]*)+)
+    regex: '([^ ])\"(?<time>[^ ]+)\"\s([^ ]+)\=(?<log_level>[.+a-zA-Z]+)\s([^ ]+)\"(?<msg>([^ ]*\s+[^ ]*\s[a-zA-Z0-9]*)+)'
diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 6a4a14a8e0d..16f4fa5cb30 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -53,14 +53,14 @@ parsers:
 
   - name: docker-daemon
     format: regex
-    regex: time="(?<time>[^ ]*)" level=(?<level>[^ ]*) msg="(?<msg>[^ ].*)"
+    regex: 'time="(?<time>[^ ]*)" level=(?<level>[^ ]*) msg="(?<msg>[^ ].*)"'
     time_key: time
     time_format: '%Y-%m-%dT%H:%M:%S.%L'
     time_keep: On
 
   - name: syslog-rfc5424
     format: regex
-    regex: ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$
+    regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$'
     time_key: time
     time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
     time_keep: On
@@ -74,7 +74,7 @@ parsers:
 
   - name: syslog-rfc3164
     format: regex
-    regex: '/^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/'
+    regex: '^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$'
     time_key: time
     time_format: '%b %d %H:%M:%S'
     time_keep: On
@@ -105,7 +105,7 @@ parsers:
   - name: cri
     # https://rubular.com/r/tjUt3Awgg4
     format: regex
-    regex: ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
+    regex: '^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$'
     time_key: time
     time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
     time_keep: On
diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index c3c294f68b1..76b752070c8 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -53,11 +53,11 @@ parsers:
 
   - name: universal
     format: regex
-    regex: ^(?<message>.*)$
+    regex: '^(?<message>.*)$'
 
   - name: uuid
     format: regex
-    regex: (?<uuid>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})
+    regex: '(?<uuid>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})'
     #UUID v1 :
     #/^[0-9A-F]{8}-[0-9A-F]{4}-[1][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
     #UUID v2 :
diff --git a/conf/parsers_java.yaml b/conf/parsers_java.yaml
index e6b739c5c96..a877522b8b7 100644
--- a/conf/parsers_java.yaml
+++ b/conf/parsers_java.yaml
@@ -1,6 +1,6 @@
 parsers:
   - name: java_multiline
     format: regex
-    regex: '/^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)/'
+    regex: '^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)'
     time_key: time
     time_format: '%Y-%m-%d %H:%M:%S'
diff --git a/conf/parsers_mult.yaml b/conf/parsers_mult.yaml
index 34bc2c58350..add68d5a628 100644
--- a/conf/parsers_mult.yaml
+++ b/conf/parsers_mult.yaml
@@ -1,13 +1,13 @@
 parsers:
   - name: mult_first
     format: regex
-    regex: Started (?<method>[^ ]+) "(?<path>[^"]+)" for (?<host>[^ ]+) at (?<time>[^ ]+ [^ ]+ [^ ]+)
+    regex: 'Started (?<method>[^ ]+) "(?<path>[^"]+)" for (?<host>[^ ]+) at (?<time>[^ ]+ [^ ]+ [^ ]+)'
     time_key: time
     time_format: '%Y-%m-%d %H:%M:%S %z'
 
   - name: mult_1
     format: regex
-    regex: /Processing by (?<controller>[^\u0023]+)\u0023(?<controller_method>[^ ]+) as (?<format>[^ ]+?)$/
+    regex: 'Processing by (?<controller>[^\u0023]+)\u0023(?<controller_method>[^ ]+) as (?<format>[^ ]+?)$'
 
   - name: mult_2
     format: regex
@@ -15,7 +15,7 @@ parsers:
 
   - name: mult_3
     format: regex
-    regex: /  Rendered (?<template>[^ ]+) within (?<layout>.+) \([\d\.]+ms\)/
+    regex: '  Rendered (?<template>[^ ]+) within (?<layout>.+) \([\d\.]+ms\)'
 
   - name: mult_4
     format: regex
diff --git a/conf/parsers_multiline.yaml b/conf/parsers_multiline.yaml
index 2c7592e86fd..bc6f2c510b4 100644
--- a/conf/parsers_multiline.yaml
+++ b/conf/parsers_multiline.yaml
@@ -4,9 +4,9 @@ multiline_parsers:
     flush_timeout: 1000
     rules:
       - state: start_state
-        regex: '/(Dec \d+ \d+\:\d+\:\d+)(.*)/'
+        regex: '(Dec \d+ \d+\:\d+\:\d+)(.*)'
         next_state: cont
 
       - state: cont
-        regex: /^\s+at.*/
+        regex: '^\s+at.*'
         next_state: cont
diff --git a/tests/internal/data/config_format/yaml/extra_parser.yaml b/tests/internal/data/config_format/yaml/extra_parser.yaml
index abbf29bd98c..bcf0a903d8b 100644
--- a/tests/internal/data/config_format/yaml/extra_parser.yaml
+++ b/tests/internal/data/config_format/yaml/extra_parser.yaml
@@ -8,9 +8,9 @@ multiline_parsers:
     flush_timeout: 1000
     rules:
       - state: start_state
-        regex: "/(Dec \\d+ \\d+\\:\\d+\\:\\d+)(.*)/"
+        regex: '(Dec \d+ \d+\:\d+\:\d+)(.*)'
         next_state: cont
 
       - state: cont
-        regex: "/^\\s+at.*/"
+        regex: '^\s+at.*'
         next_state: cont

From 649c53096fdbcf36b269843ec2802a19e2b72f1a Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 21:57:31 -0700
Subject: [PATCH 04/19] conf: parser: expand kmsg-netfilter-log to an
 extended-regex

No change in behavior, confirmed w/test harness.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 16f4fa5cb30..3e5254b77bd 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -117,6 +117,34 @@ parsers:
   - name: kmsg-netfilter-log
     # Examples: TCP: https://rubular.com/r/Q8YY6fHqlqwGI0  UDP: https://rubular.com/r/B0ID69H9FvN0tp
     format: regex
-    regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) kernel - - - \[[0-9\.]*\] (?<logprefix>[^ ]*)\s?IN=(?<in>[^ ]*) OUT=(?<out>[^ ]*) MAC=(?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<ethtype>[0-9a-f]{2}:[0-9a-f]{2}) SRC=(?<saddr>[^ ]*) DST=(?<daddr>[^ ]*) LEN=(?<len>[^ ]*) TOS=(?<tos>[^ ]*) PREC=(?<prec>[^ ]*) TTL=(?<ttl>[^ ]*) ID=(?<id>[^ ]*) (D*F*)\s*PROTO=(?<proto>[^ ]*)\s?((SPT=)?(?<sport>[0-9]*))\s?((DPT=)?(?<dport>[0-9]*))\s?((LEN=)?(?<protolen>[0-9]*))\s?((WINDOW=)?(?<window>[0-9]*))\s?((RES=)?(?<res>0?x?[0-9]*))\s?(?<flag>[^ ]*)\s?((URGP=)?(?<urgp>[0-9]*))'
+    regex: |
+      (?x)
+      ^
+        \<(?<pri>[0-9]{1,5})\>1\s
+        (?<time>[^\s]+)\s
+        (?<host>[^\s]+)\s
+        kernel\s -\s -\s -\s \[[0-9\.]*\]\s
+        (?<logprefix>[^\s]*)\s?
+        IN=(?<in>[^\s]*)\s
+        OUT=(?<out>[^\s]*)\s
+        MAC= (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        :    (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        :    (?<ethtype>[0-9a-f]{2}:[0-9a-f]{2})\s
+        SRC=(?<saddr>[^\s]*)\s
+        DST=(?<daddr>[^\s]*)\s
+        LEN=(?<len>[^\s]*)\s
+        TOS=(?<tos>[^\s]*)\s
+        PREC=(?<prec>[^\s]*)\s
+        TTL=(?<ttl>[^\s]*)\s
+        ID=(?<id>[^\s]*)\s
+        (D*F*)\s*
+        PROTO=(?<proto>[^\s]*)\s?
+        ( (SPT=)? (?<sport>[0-9]*) )\s?
+        ( (DPT=)? (?<dport>[0-9]*) )\s?
+        ( (LEN=)? (?<protolen>[0-9]*) )\s?
+        ( (WINDOW=)? (?<window>[0-9]*) )\s?
+        ( (RES=)? (?<res>0?x?[0-9]*) )\s?
+        (?<flag>[^\s]*)\s?
+        ( (URGP=)? (?<urgp>[0-9]*) )
     time_key: time
     time_format: '%Y-%m-%dT%H:%M:%S.%L%z'

From 45448eb142a3af903530fe6ca964d01d85071209 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 21:58:33 -0700
Subject: [PATCH 05/19] conf: parser: kmsg-netfilter-log: fix kernel uptime
 matching

Linux kernel uptime timestamps use "[%5lu.%06lu]", meaning there
are leading spaces inside the [ ] until uptime reaches 10,000 secs.
The existing test-cases both have 6-digit seconds, so this wasn't
noticed.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 3e5254b77bd..88393b0b410 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -123,7 +123,7 @@ parsers:
         \<(?<pri>[0-9]{1,5})\>1\s
         (?<time>[^\s]+)\s
         (?<host>[^\s]+)\s
-        kernel\s -\s -\s -\s \[[0-9\.]*\]\s
+        kernel\s -\s -\s -\s \[\s*[0-9\.]*\]\s
         (?<logprefix>[^\s]*)\s?
         IN=(?<in>[^\s]*)\s
         OUT=(?<out>[^\s]*)\s

From 6c9074293e8fae075488bcf719b4ae0a76c1cc7e Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 22:05:36 -0700
Subject: [PATCH 06/19] conf: parser: kmsg-netfilter-log: fix MAC= parsing

Linux firewall logs' MAC= field is in wire order - dst MAC, then
src MAC, then ethertype.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 88393b0b410..e6de8a1cce4 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -127,8 +127,8 @@ parsers:
         (?<logprefix>[^\s]*)\s?
         IN=(?<in>[^\s]*)\s
         OUT=(?<out>[^\s]*)\s
-        MAC= (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
-        :    (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        MAC= (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        :    (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
         :    (?<ethtype>[0-9a-f]{2}:[0-9a-f]{2})\s
         SRC=(?<saddr>[^\s]*)\s
         DST=(?<daddr>[^\s]*)\s

From 05337efbbf9a3ea506a788a6cb20552eea248e8a Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 12:25:45 -0700
Subject: [PATCH 07/19] conf: parser: add test cases for rfc5424

Pulled these out of https://hackmd.io/@njjack/syslogformat, I _think_
all three are valid. The current pattern only matches on the first two.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml                                              | 1 +
 .../data/config_format/convert/parsers.syslog-rfc5424.test     | 3 +++
 2 files changed, 4 insertions(+)
 create mode 100644 tests/internal/data/config_format/convert/parsers.syslog-rfc5424.test

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index e6de8a1cce4..2b6793f2cc3 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -59,6 +59,7 @@ parsers:
     time_keep: On
 
   - name: syslog-rfc5424
+    # https://rubular.com/r/PMypubVdqyOTT0
     format: regex
     regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$'
     time_key: time
diff --git a/tests/internal/data/config_format/convert/parsers.syslog-rfc5424.test b/tests/internal/data/config_format/convert/parsers.syslog-rfc5424.test
new file mode 100644
index 00000000000..60f8b79a76d
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.syslog-rfc5424.test
@@ -0,0 +1,3 @@
+<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8
+<165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"] BOMAn application event log entry...
+<165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"][examplePriority@32473 class="high"]

From 4e529ccc04f9af4442b8e53ac66b194d7992f95e Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 14:38:13 -0700
Subject: [PATCH 08/19] conf: parser: fix syslog-rfc5424 regex - msg is
 optional

See https://hackmd.io/@njjack/syslogformat

With this change, we match the third test-case as well.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 2b6793f2cc3..3d5710cc07c 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -61,7 +61,7 @@ parsers:
   - name: syslog-rfc5424
     # https://rubular.com/r/PMypubVdqyOTT0
     format: regex
-    regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$'
+    regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-))(?: (?<message>.+))?$'
     time_key: time
     time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
     time_keep: On

From 8bebc7d8a05a1bc4771f682c62f6d03ba699b245 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 16:02:56 -0700
Subject: [PATCH 09/19] conf: parser: parsers_extra.yaml: Associate comment
 with the correct stanza

---
 conf/parsers_extra.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index 76b752070c8..04f45fee5cb 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -68,10 +68,9 @@ parsers:
     #/^[0-9A-F]{8}-[0-9A-F]{4}-[4][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
     #UUID v5 :
     #/^[0-9A-F]{8}-[0-9A-F]{4}-[5][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
-    #
-    # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
 
   - name: iptables
+    # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
     format: regex
     regex: '\[(?<rule_chain>\w*)-(?<rule_name>\w*)-(?<accept_or_drop>\w*)\]IN=(?<in_interface>[\w.]+)? OUT=(?<out_interface>[\w.]+)? MAC=(?<mac_address>[\w:]+)? SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) LEN=(?<pkt_len>\d+) TOS=(?<pkt_tos>[\w\d]+) PREC=(?<pkt_prec>[\w\d]+) TTL=(?<pkt_ttl>\d+) ID=(?<pkt_id>\d+)\s?(?<pkg_frg>[A-Z\s].?)\s?PROTO=(?<protocol>[\w\d]+) (SPT=(?<source_port>.*) DPT=(?<dest_port>.*) (LEN=(?<proto_pkt_len>\w+)?)?(WINDOW=(?<proto_window_size>\d+) RES=(?<pkt_res>\w+)? (?<pkt_type>\w+)\s((?<pkt_flag>\w+)?)\s?URGP=(?<pkg_urgency>\d))? )?(TYPE=(?<pkt_icmp_type>\d+) CODE=(?<pkt_icmp_code>\d+) ID=(?<pkt_icmp_id>\d+) SEQ=(?<pkt_icmp_seq>\d+) )?$'
     types: 'source_port:integer,dest_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer'

From 8fec818f7e3556de6b027323171bb91afc61a524 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 17:25:34 -0700
Subject: [PATCH 10/19] conf: parser: iptables: link to the reference example
 logs + add test case

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml                               |  1 +
 .../config_format/convert/parsers_extra.iptables.test | 11 +++++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 tests/internal/data/config_format/convert/parsers_extra.iptables.test

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index 04f45fee5cb..bd6276f4383 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -71,6 +71,7 @@ parsers:
 
   - name: iptables
     # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
+    # https://regex101.com/r/VBRq81/1
     format: regex
     regex: '\[(?<rule_chain>\w*)-(?<rule_name>\w*)-(?<accept_or_drop>\w*)\]IN=(?<in_interface>[\w.]+)? OUT=(?<out_interface>[\w.]+)? MAC=(?<mac_address>[\w:]+)? SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) LEN=(?<pkt_len>\d+) TOS=(?<pkt_tos>[\w\d]+) PREC=(?<pkt_prec>[\w\d]+) TTL=(?<pkt_ttl>\d+) ID=(?<pkt_id>\d+)\s?(?<pkg_frg>[A-Z\s].?)\s?PROTO=(?<protocol>[\w\d]+) (SPT=(?<source_port>.*) DPT=(?<dest_port>.*) (LEN=(?<proto_pkt_len>\w+)?)?(WINDOW=(?<proto_window_size>\d+) RES=(?<pkt_res>\w+)? (?<pkt_type>\w+)\s((?<pkt_flag>\w+)?)\s?URGP=(?<pkg_urgency>\d))? )?(TYPE=(?<pkt_icmp_type>\d+) CODE=(?<pkt_icmp_code>\d+) ID=(?<pkt_icmp_id>\d+) SEQ=(?<pkt_icmp_seq>\d+) )?$'
     types: 'source_port:integer,dest_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer'
diff --git a/tests/internal/data/config_format/convert/parsers_extra.iptables.test b/tests/internal/data/config_format/convert/parsers_extra.iptables.test
new file mode 100644
index 00000000000..ceaa811ae3a
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_extra.iptables.test
@@ -0,0 +1,11 @@
+[LAN_IN-2001-A]IN=eth1.40 OUT=eth1 MAC=fc:ec:da:47:47:e6:64:5d:86:dd:43:66:08:00:45:00:00:4c SRC=10.231.40.102 DST=10.231.1.21 LEN=76 TOS=0x00 PREC=0x00 TTL=63 ID=47001 DF PROTO=UDP SPT=52295 DPT=53 LEN=56 
+[LAN_LOCAL-default-A]IN=eth1 OUT= MAC= SRC=10.231.1.1 DST=224.0.0.251 LEN=257 TOS=0x00 PREC=0x00 TTL=255 ID=19888 PROTO=UDP SPT=5353 DPT=5353 LEN=237 
+[LAN_IN-2005-A]IN=eth1 OUT=eth1.20 MAC=fc:ec:da:47:47:e6:b4:2e:99:19:8e:79:08:00 SRC=10.231.1.21 DST=10.231.20.2 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=47505 DF PROTO=TCP SPT=54668 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 
+[LAN_IN-2001-A]IN=eth1.40 OUT=eth1 MAC=fc:ec:da:47:47:e6:3e:28:89:63:06:05:08:00:45:00:00:50 SRC=10.231.40.100 DST=10.231.1.21 LEN=80 TOS=0x00 PREC=0x00 TTL=63 ID=39238 PROTO=UDP SPT=50915 DPT=53 LEN=60 
+[LAN_LOCAL-default-A]IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:68:54:5a:6f:b9:c7:08:00 SRC=10.231.1.135 DST=10.231.1.255 LEN=72 TOS=0x00 PREC=0x00 TTL=64 ID=19104 DF PROTO=UDP SPT=57621 DPT=57621 LEN=52 
+[LAN_LOCAL-default-A]IN=eth1 OUT= MAC= SRC=10.231.1.1 DST=224.0.0.251 LEN=257 TOS=0x00 PREC=0x00 TTL=255 ID=32703 DF PROTO=UDP SPT=5353 DPT=5353 LEN=237 
+[LAN_LOCAL-default-A]IN=eth1 OUT= MAC= SRC=10.231.1.1 DST=224.0.0.251 LEN=810 TOS=0x00 PREC=0x00 TTL=255 ID=33948 DF PROTO=UDP SPT=5353 DPT=5353 LEN=790 
+[WAN_LOCAL-default-D]IN=pppoe0 OUT= MAC= SRC=111.50.82.233 DST=51.148.135.105 LEN=52 TOS=0x00 PREC=0x00 TTL=110 ID=28588 DF PROTO=TCP SPT=61114 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0 
+[LAN_LOCAL-default-A]IN=eth1.20 OUT= MAC= SRC=10.231.20.1 DST=224.0.0.2 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2 
+[LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK FIN URGP=0 
+[LAN_LOCAL-default-A]IN=eth1.20 OUT= MAC=fc:ec:da:47:47:e6:14:0a:c5:8c:ae:e6:08:00:45:00:00:54 SRC=10.231.20.52 DST=10.231.20.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=44298 DF PROTO=ICMP TYPE=8 CODE=0 ID=56026 SEQ=47360 

From 68aedeff7500ae237353700a6fa024ce75e9acb4 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 17:36:00 -0700
Subject: [PATCH 11/19] conf: parser: expand iptables to an extended-regex

No change in behavior, confirmed w/test harness.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index bd6276f4383..9d6b9a937c9 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -73,7 +73,40 @@ parsers:
     # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
     # https://regex101.com/r/VBRq81/1
     format: regex
-    regex: '\[(?<rule_chain>\w*)-(?<rule_name>\w*)-(?<accept_or_drop>\w*)\]IN=(?<in_interface>[\w.]+)? OUT=(?<out_interface>[\w.]+)? MAC=(?<mac_address>[\w:]+)? SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) LEN=(?<pkt_len>\d+) TOS=(?<pkt_tos>[\w\d]+) PREC=(?<pkt_prec>[\w\d]+) TTL=(?<pkt_ttl>\d+) ID=(?<pkt_id>\d+)\s?(?<pkg_frg>[A-Z\s].?)\s?PROTO=(?<protocol>[\w\d]+) (SPT=(?<source_port>.*) DPT=(?<dest_port>.*) (LEN=(?<proto_pkt_len>\w+)?)?(WINDOW=(?<proto_window_size>\d+) RES=(?<pkt_res>\w+)? (?<pkt_type>\w+)\s((?<pkt_flag>\w+)?)\s?URGP=(?<pkg_urgency>\d))? )?(TYPE=(?<pkt_icmp_type>\d+) CODE=(?<pkt_icmp_code>\d+) ID=(?<pkt_icmp_id>\d+) SEQ=(?<pkt_icmp_seq>\d+) )?$'
+    regex: |
+      (?x)
+       \[ (?<rule_chain>\w*) - (?<rule_name>\w*) - (?<accept_or_drop>\w*) \]
+       IN=(?<in_interface>[\w.]+)?\s
+       OUT=(?<out_interface>[\w.]+)?\s
+       MAC=(?<mac_address>[\w:]+)?\s
+       SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\s
+       DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\s
+       LEN=(?<pkt_len>\d+)\s
+       TOS=(?<pkt_tos>[\w\d]+)\s
+       PREC=(?<pkt_prec>[\w\d]+)\s
+       TTL=(?<pkt_ttl>\d+)\s
+       ID=(?<pkt_id>\d+)\s?
+       (?<pkg_frg>[A-Z\s].?)\s?
+       PROTO=(?<protocol>[\w\d]+)\s
+       (
+        SPT=(?<source_port>.*)\s
+        DPT=(?<dest_port>.*)\s
+        ( LEN=(?<proto_pkt_len>\w+)? )?
+        (
+         WINDOW=(?<proto_window_size>\d+)\s
+         RES=(?<pkt_res>\w+)?\s
+         (?<pkt_type>\w+)\s
+         ( (?<pkt_flag>\w+)? )\s?
+         URGP=(?<pkg_urgency>\d)
+        )?\s
+       )?
+       (
+        TYPE=(?<pkt_icmp_type>\d+)\s
+        CODE=(?<pkt_icmp_code>\d+)\s
+        ID=(?<pkt_icmp_id>\d+)\s
+        SEQ=(?<pkt_icmp_seq>\d+)\s
+       )?
+       $
     types: 'source_port:integer,dest_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer'
 
   - name: couchbase_json_log_nanoseconds

From 8ca027f324dfd4933c3ef0553b73f183abe3ebe5 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 18:24:06 -0700
Subject: [PATCH 12/19] conf: parser: iptables: break out MAC= section, fix a
 typo

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index 9d6b9a937c9..e739b97ecee 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -78,7 +78,21 @@ parsers:
        \[ (?<rule_chain>\w*) - (?<rule_name>\w*) - (?<accept_or_drop>\w*) \]
        IN=(?<in_interface>[\w.]+)?\s
        OUT=(?<out_interface>[\w.]+)?\s
-       MAC=(?<mac_address>[\w:]+)?\s
+
+       # MAC can be missing or empty
+       (?:
+        MAC=
+        (?:
+         (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+         :
+         (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+         :
+         # Ether type can be longer when processing incoming VLAN-tagged packets
+         (?<ethtype>[0-9a-f]{2} (?::[0-9a-f]{2})+ )
+        )?
+        \s
+       )?
+
        SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\s
        DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\s
        LEN=(?<pkt_len>\d+)\s
@@ -86,7 +100,7 @@ parsers:
        PREC=(?<pkt_prec>[\w\d]+)\s
        TTL=(?<pkt_ttl>\d+)\s
        ID=(?<pkt_id>\d+)\s?
-       (?<pkg_frg>[A-Z\s].?)\s?
+       (?<pkt_frg>[A-Z\s].?)\s?
        PROTO=(?<protocol>[\w\d]+)\s
        (
         SPT=(?<source_port>.*)\s

From 0648bdb1c3a7307881226b2fa5b6b947639093e4 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 21:58:52 -0700
Subject: [PATCH 13/19] conf: parser: iptables: add a test-case that is
 currently missed

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml                                         | 2 +-
 .../data/config_format/convert/parsers_extra.iptables.test      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index e739b97ecee..4417b2ff32c 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -71,7 +71,7 @@ parsers:
 
   - name: iptables
     # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
-    # https://regex101.com/r/VBRq81/1
+    # https://regex101.com/r/tzK8mr/1
     format: regex
     regex: |
       (?x)
diff --git a/tests/internal/data/config_format/convert/parsers_extra.iptables.test b/tests/internal/data/config_format/convert/parsers_extra.iptables.test
index ceaa811ae3a..8a8dfa9abef 100644
--- a/tests/internal/data/config_format/convert/parsers_extra.iptables.test
+++ b/tests/internal/data/config_format/convert/parsers_extra.iptables.test
@@ -9,3 +9,4 @@
 [LAN_LOCAL-default-A]IN=eth1.20 OUT= MAC= SRC=10.231.20.1 DST=224.0.0.2 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2 
 [LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK FIN URGP=0 
 [LAN_LOCAL-default-A]IN=eth1.20 OUT= MAC=fc:ec:da:47:47:e6:14:0a:c5:8c:ae:e6:08:00:45:00:00:54 SRC=10.231.20.52 DST=10.231.20.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=44298 DF PROTO=ICMP TYPE=8 CODE=0 ID=56026 SEQ=47360 
+[LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK PSH FIN URGP=0 

From 2ed5cb0cc73dbc45505c98c08a376372273937d6 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 22:24:46 -0700
Subject: [PATCH 14/19] tests: config_format: more compare methods to test
 improvements

Strictly OK/FAIL when the before-after don't match is less useful
when we are making improvements that introduce changes on purpose.
Change labels to MATCH/NO MATCH, and also add -c which shows the
wc of output lines - much easier to confirm when updates cause
more tests to successfully match.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 .../data/config_format/convert/run_tests.sh   | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/tests/internal/data/config_format/convert/run_tests.sh b/tests/internal/data/config_format/convert/run_tests.sh
index 8b221e1ea63..16c2f6c5480 100755
--- a/tests/internal/data/config_format/convert/run_tests.sh
+++ b/tests/internal/data/config_format/convert/run_tests.sh
@@ -26,7 +26,7 @@ squash_date()
   sed -E 's/"date":[0-9]+\.[0-9]+,/"date":1234567890.123456,/'
 }
 
-# Unless in verbose mode, flatten each output to a checksum of itself
+# In default terse mode, flatten each output to a checksum of itself
 filter()
 {
   squash_date | sha256sum | cut -d\  -f1
@@ -34,7 +34,7 @@ filter()
 
 usage()
 {
-  die "Usage: $0 [-v] [file1.test [file2.test ...]]
+  die "Usage: $0 [-c|-v] [file1.test [file2.test ...]]
 
   Process parser*.*.test files, either each one named on the command line,
   or every file in pwd matching that pattern.
@@ -42,14 +42,20 @@ usage()
   Makes sure the output produced by the .conf file and .yaml configs match.
 
   Needs a corresponding .conf and .yaml for each.
+
+  By default compare hashes of outputs; alternately:
+   -c  Show and compare wc of the output (easy to spot gross differences)
+   -v  Show and compare full verbose outputs (expose all details)
 "
 }
 
-# Empty output (or a hash of an empty string) is a sure sign of failure
+# Empty output, count of empty output, or hash of an empty string
+# is a sure sign of failure
 check_output()
 {
   local check="$1"
   [[ "$check" = "" ]] || \
+  [[ "$check" =~ ^\s+[01]\s+0\s+[01]$ ]] || \
   [[ "$check" = "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b" ]] || \
   [[ "$check" = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ]] && \
 	echo -e "\n" && die "### FAIL '$TEST_FILE' output was empty"
@@ -59,6 +65,7 @@ TEST_FILES=()
 
 for arg in "$@"; do
   case "$arg" in
+    -c) filter() { squash_date | wc; }; ;;
     -v) filter() { squash_date; }; ;;
     -*) usage ;;
     *)  TEST_FILES+=("$arg") ;;
@@ -80,7 +87,8 @@ for TEST_FILE in "${TEST_FILES[@]}" ; do
   PARSER_FILE="${BASH_REMATCH[1]}"
   PARSER_NAME="${BASH_REMATCH[2]}"
 
-  echo "### '$TEST_FILE'"
+  LINES=$(wc -l < "$TEST_FILE")
+  echo "### '$TEST_FILE': $LINES lines"
   [[ -e ${PARSER_FILE}.conf ]] || { warn "'${TEST_FILE}': legacy '${PARSER_FILE}.conf' not found, skipping"; continue; }
   [[ -e ${PARSER_FILE}.yaml ]] || { warn "'${TEST_FILE}': new '${PARSER_FILE}.yaml' not found, skipping"; continue; }
   echo -n "CONF: ";
@@ -92,9 +100,9 @@ for TEST_FILE in "${TEST_FILES[@]}" ; do
   check_output "$YAML_OUT"
   echo "$YAML_OUT"
   if [[ "$CONF_OUT" == "$YAML_OUT" ]]; then
-    echo "### OK '$TEST_FILE'"
+    echo "### MATCH '$TEST_FILE'"
   else
-    die "### FAIL '$TEST_FILE'"
+    die "### NO MATCH '$TEST_FILE'"
   fi
   echo
 done

From d49e74fc7d14f9b6126886d3fe2de076bed6e3b0 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 22:28:11 -0700
Subject: [PATCH 15/19] conf: parser: iptables: fixes so more test cases match

Also more whitespace and comments for legibility.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index 4417b2ff32c..5096a7639c6 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -75,7 +75,10 @@ parsers:
     format: regex
     regex: |
       (?x)
+
+       # Log prefix - depends on the rule-building tools
        \[ (?<rule_chain>\w*) - (?<rule_name>\w*) - (?<accept_or_drop>\w*) \]
+
        IN=(?<in_interface>[\w.]+)?\s
        OUT=(?<out_interface>[\w.]+)?\s
 
@@ -101,19 +104,27 @@ parsers:
        TTL=(?<pkt_ttl>\d+)\s
        ID=(?<pkt_id>\d+)\s?
        (?<pkt_frg>[A-Z\s].?)\s?
+
+       # TCP and UDP have some next fields in common
        PROTO=(?<protocol>[\w\d]+)\s
        (
-        SPT=(?<source_port>.*)\s
-        DPT=(?<dest_port>.*)\s
-        ( LEN=(?<proto_pkt_len>\w+)? )?
+        SPT=(?<source_port>\d+)\s
+        DPT=(?<dest_port>\d+)\s
+        ( LEN=(?<proto_pkt_len>\w+)? \s )?
         (
+         (?:
+          SEQ=(?<tcp_seq>\d+)\s
+          ACK=(?<tcp_ack>\d+)\s
+         )?
          WINDOW=(?<proto_window_size>\d+)\s
          RES=(?<pkt_res>\w+)?\s
          (?<pkt_type>\w+)\s
-         ( (?<pkt_flag>\w+)? )\s?
-         URGP=(?<pkg_urgency>\d)
-        )?\s
+         ( (?<pkt_flag>\w+)? \s )*
+         URGP=(?<pkg_urgency>\d)\s
+        )?
        )?
+
+       # ICMP is the next most likely protocol
        (
         TYPE=(?<pkt_icmp_type>\d+)\s
         CODE=(?<pkt_icmp_code>\d+)\s

From 192a1e55f9a05a0c8162cf00144df0c072f70661 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Mon, 17 Nov 2025 22:42:39 -0700
Subject: [PATCH 16/19] conf: parser: iptables: capture all TCP flags to
 pkt_flag

The previous implementation would clobber and only remember one.
This field name is now a misnomer, pkt_flags or individual ones
for pkt_{cwr,ewe,urg...} might be better, but would break backwards
compat more substantially.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index 5096a7639c6..f8bdbbcce0a 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -119,7 +119,7 @@ parsers:
          WINDOW=(?<proto_window_size>\d+)\s
          RES=(?<pkt_res>\w+)?\s
          (?<pkt_type>\w+)\s
-         ( (?<pkt_flag>\w+)? \s )*
+         (?<pkt_flag> (?:[A-Z]+\s)* )
          URGP=(?<pkg_urgency>\d)\s
         )?
        )?

From 053956940df61a5184cef84756928cbcf2d9c3de Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Tue, 18 Nov 2025 18:02:54 -0700
Subject: [PATCH 17/19] tests: config_format: iptables: Add many examples not
 currently supported

Other firewall-building tools (UFW, firewalld, etc.) craft their
line prefix differently, causing the rest of the regex to fail.
Also some errors and more exotic message contents.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml                           |  5 +++--
 .../convert/parsers_extra.iptables.test           | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index f8bdbbcce0a..44417040b27 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -70,8 +70,9 @@ parsers:
     #/^[0-9A-F]{8}-[0-9A-F]{4}-[5][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
 
   - name: iptables
-    # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
-    # https://regex101.com/r/tzK8mr/1
+    # Parse IP Tables rules
+    # N.B. ipv4 only
+    # https://rubular.com/r/VEqBcImT3lav1K
     format: regex
     regex: |
       (?x)
diff --git a/tests/internal/data/config_format/convert/parsers_extra.iptables.test b/tests/internal/data/config_format/convert/parsers_extra.iptables.test
index 8a8dfa9abef..cd06fbbd9bd 100644
--- a/tests/internal/data/config_format/convert/parsers_extra.iptables.test
+++ b/tests/internal/data/config_format/convert/parsers_extra.iptables.test
@@ -10,3 +10,18 @@
 [LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK FIN URGP=0 
 [LAN_LOCAL-default-A]IN=eth1.20 OUT= MAC=fc:ec:da:47:47:e6:14:0a:c5:8c:ae:e6:08:00:45:00:00:54 SRC=10.231.20.52 DST=10.231.20.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=44298 DF PROTO=ICMP TYPE=8 CODE=0 ID=56026 SEQ=47360 
 [LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK PSH FIN URGP=0 
+[17043827.627166] filter_IN_public_REJECT: IN=ens18 OUT= MAC=ff:ff:ff:ff:ff:ff:4c:41:42:60:17:f7:08:00 SRC=172.33.9.172 DST=172.54.7.213 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=715 PROTO=UDP SPT=138 DPT=138 LEN=209 
+[17286083.004815] [UFW ALLOW] IN= OUT=ens18 SRC=172.27.6.134 DST=172.22.3.8 LEN=275 TOS=0x00 PREC=0x00 TTL=255 ID=1957 DF PROTO=UDP SPT=26622 DPT=514 LEN=255 
+[17286084.151998] [UFW AUDIT] IN=ens18 OUT= MAC=bc:24:11:43:51:f1:90:e2:ba:03:35:f9:08:00 SRC=172.22.3.8 DST=172.27.6.134 LEN=48 TOS=0x00 PREC=0x00 TTL=255 ID=47061 DF PROTO=TCP SPT=43848 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0 
+[17377855.003423] [UFW BLOCK] IN=ens18 OUT= MAC=bc:24:11:43:51:f1:bc:24:11:90:09:82:08:00 SRC=172.15.5.77 DST=172.27.6.134 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=43316 DF PROTO=TCP SPT=43902 DPT=999 WINDOW=64240 RES=0x00 SYN URGP=0 
+[UFW BLOCK] IN=ens18 OUT= MAC=01:00:5e:00:00:fb:4c:41:42:3c:cf:1c:08:00 SRC=172.79.1.173 DST=226.2.1.222 LEN=73 TOS=0x00 PREC=0x00 TTL=255 ID=37808 DF PROTO=UDP SPT=5353 DPT=5353 LEN=53 
+[4805310.266869] FW: forward DROP IN=ppp0 OUT=eth1 MAC= SRC=49.208.208.102 DST=31.11.105.81 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=63854 PROTO=TCP SPT=41651 DPT=17828 SEQ=1604673260 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 
+FW: output ACCEPT IN= OUT=ppp0 SRC=80.45.189.60 DST=124.223.255.7 LEN=120 TOS=0x00 PREC=0x00 TTL=255 ID=26952 PROTO=UDP SPT=34698 DPT=53 LEN=100 UID=40 GID=40 
+FW: input ACCEPT IN=eth0 OUT= MAC=b4:2e:99:a3:85:67:c4:ad:34:32:32:df:08:00 SRC=10.6.2.3 DST=10.24.22.19 LEN=576 TOS=0x00 PREC=0xC0 TTL=254 ID=64723 PROTO=ICMP TYPE=3 CODE=4 [SRC=10.24.22.19 DST=203.61.18.149 LEN=2083 TOS=0x00 PREC=0x00 TTL=254 ID=31331 DF PROTO=TCP SPT=18252 DPT=443 WINDOW=502 RES=0x00 ACK PSH URGP=0 ] MTU=1492 
+FW: forward DROP IN=ppp0 OUT=eth1 MAC= SRC=19.155.185.156 DST=51.56.241.88 LEN=119 TOS=0x00 PREC=0xC0 TTL=53 ID=31027 PROTO=ICMP TYPE=3 CODE=3 [SRC=51.56.241.88 DST=19.155.185.156 LEN=91 TOS=0x00 PREC=0x00 TTL=243 ID=63387 PROTO=UDP SPT=46210 DPT=25172 LEN=71 ] 
+[4805310.137667] nf_ct_proto_6: packet (index 1) in dir 1 ignored, state SYN_RECV IN=eth1 OUT= MAC=00:ec:ac:ce:b3:63:00:1b:21:54:1c:3d:08:00 SRC=39.76.232.40 DST=246.97.70.56 LEN=48 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=443 DPT=14129 SEQ=158435768 ACK=2043537019 WINDOW=65340 RES=0x00 ACK SYN URGP=0 OPT (020405AC01030307) 
+nf_ct_proto_6: invalid new IN=eth2 OUT= MAC=00:ec:ac:ce:b3:64:50:e0:85:84:a1:61:08:00 SRC=192.168.9.182 DST=109.250.21.12 LEN=71 TOS=0x00 PREC=0x00 TTL=128 ID=29429 DF PROTO=TCP SPT=61919 DPT=443 SEQ=438203318 ACK=2825421336 WINDOW=510 RES=0x00 ACK PSH FIN URGP=0 
+[4805337.689552] nf_ct_proto_6: bad checksum IN=ppp0 OUT= MAC= SRC=155.146.130.32 DST=39.76.232.40 LEN=447 TOS=0x00 PREC=0x00 TTL=55 ID=39575 DF PROTO=TCP SPT=36187 DPT=443 SEQ=3240783289 ACK=3631033297 WINDOW=1386 RES=0x00 ACK PSH URGP=0 
+nf_ct_proto_6: packet (index 1) in dir 1 ignored, state ESTABLISHED IN=eth1 OUT= MAC=00:ec:ac:ce:b3:63:90:b1:1c:3e:e7:a2:08:00 SRC=64.99.143.10 DST=42.162.203.2 LEN=48 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=443 DPT=16426 SEQ=739183654 ACK=166439761 WINDOW=65340 RES=0x00 ACK SYN URGP=0 OPT (020405AC01030307) 
+[ 1156.246182] calico-drop: IN=tunl0 OUT=cali76be879f658 MAC= SRC=192.168.128.30 DST=192.168.157.26 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=56743 DF PROTO=TCP SPT=56248 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0xa000000 
+FW: input ACCEPT IN=ib0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:08:00:00:00 SRC=10.2.7.172 DST=10.2.6.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=51724 DF PROTO=TCP SPT=934 DPT=60219 SEQ=1823043416 ACK=0 WINDOW=65480 RES=0x00 SYN URGP=0 

From c9225390adcd5af71f51d5131cd1f867f704d204 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Wed, 19 Nov 2025 18:32:17 -0700
Subject: [PATCH 18/19] conf: parser: iptables: Handle many more message types,
 more fields

Address prefixes added by different tools, parse payloads in
ICMP errors, support --log-uid logs, etc. Note that this _does_
change or rename a few fields, it is not strictly additive.
Also switch regex reference to one that matches fluent-bit behavior.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers_extra.yaml | 156 ++++++++++++++++++++++++++++++++--------
 1 file changed, 127 insertions(+), 29 deletions(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index 44417040b27..ad073b2b247 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -72,13 +72,68 @@ parsers:
   - name: iptables
     # Parse IP Tables rules
     # N.B. ipv4 only
-    # https://rubular.com/r/VEqBcImT3lav1K
+    # https://regex101.com/r/DujdAl/1
     format: regex
     regex: |
       (?x)
 
+       # kernel timestamp - optional, and may have already been consumed
+       (?: \[\s* (?<kernel_uptime>[0-9]+\.[0-9]+) \]\s )?
+
        # Log prefix - depends on the rule-building tools
-       \[ (?<rule_chain>\w*) - (?<rule_name>\w*) - (?<accept_or_drop>\w*) \]
+       (?:
+
+        # Original Fluent-Bit PR #3108
+        \[
+        (?<rule_chain>\w*) -
+        (?<rule_name>\w*) -
+        (?<accept_or_drop>\w*)
+        \]
+       |
+
+        # UFW
+        \[ UFW\s (?<accept_or_drop> (?: ALLOW | AUDIT | BLOCK ) ) \] \s
+       |
+
+        # firewalld
+        (?<rule_chain>[^_]+)_
+        (?<fw_direction> (?: FWD | IN | OUT ) )_
+        (?: (?<fw_zone>[a-z0-9]+) _ )?
+        (?<accept_or_drop>[A-Z]+) : \s
+       |
+
+        # Calico
+        calico-
+        (?<accept_or_drop>\w*)
+        : \s
+       |
+
+        # other
+        FW:\s (?<fw_direction>[a-z]+) \s
+        (?<accept_or_drop>[A-Z]+) \s
+       |
+
+        # Conntrack error
+        nf_ct_proto_6:\s
+        (?:
+         (?<nf_ct_err>bad\s checksum)
+        |
+         (?<nf_ct_err>challenge-ack\s ignored)
+        |
+         (?<nf_ct_err>invalid \s
+           (?: new | rst | tcp\s flag\s combination | truncated\s packet )
+         )
+        |
+         packet\s \( index\s [0-3] \) \s
+         in\s dir\s [01]\s
+         (?<nf_ct_err>ignored) ,\s
+         state\s (?<tcp_state>[A-Z0-9_]+)
+        ) \s
+       |
+
+        # support arbitrary unknown prefixes rather than fail to match
+        (?<fw_unknown_prefix>.{1,64}?)
+       )
 
        IN=(?<in_interface>[\w.]+)?\s
        OUT=(?<out_interface>[\w.]+)?\s
@@ -100,40 +155,83 @@ parsers:
        SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\s
        DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\s
        LEN=(?<pkt_len>\d+)\s
-       TOS=(?<pkt_tos>[\w\d]+)\s
-       PREC=(?<pkt_prec>[\w\d]+)\s
+       # kernel nf_log_syslog.c mixes 0x%x and 0x%X for various hex outputs,
+       # be defensive in case someone decides to standardize some day
+       TOS=(?<pkt_tos>0x[A-Fa-f0-9]+)\s
+       PREC=(?<pkt_prec>0x[A-Fa-f0-9]+)\s
        TTL=(?<pkt_ttl>\d+)\s
-       ID=(?<pkt_id>\d+)\s?
-       (?<pkt_frg>[A-Z\s].?)\s?
-
-       # TCP and UDP have some next fields in common
-       PROTO=(?<protocol>[\w\d]+)\s
-       (
-        SPT=(?<source_port>\d+)\s
-        DPT=(?<dest_port>\d+)\s
-        ( LEN=(?<proto_pkt_len>\w+)? \s )?
-        (
+       ID=(?<pkt_id>\d+)\s
+       (?: (?<ip_df>DF) \s )?
+
+       # Get what we can out of each protocol
+       PROTO=
+       (?:
+        (?<proto>TCP) \s
+        SPT=(?<src_port>\d+) \s
+        DPT=(?<dst_port>\d+) \s
+        # Some logs are missing SEQ= and ACK=
+        (?:
+         SEQ=\d+ \s
+         ACK=\d+ \s
+        )?
+        WINDOW=(?<tcp_win>[0-9]+) \s
+        RES=0x[A-Fa-f0-9]{2} \s
+        (?: (?<tcp_flag_cwr>CWR) \s )?
+        (?: (?<tcp_ewe>EWE) \s )?
+        (?: (?<tcp_urg>URG) \s )?
+        (?: (?<tcp_ack>ACK) \s )?
+        (?: (?<tcp_psh>PSH) \s )?
+        (?: (?<tcp_rst>RST) \s )?
+        (?: (?<tcp_syn>SYN) \s )?
+        (?: (?<tcp_fin>FIN) \s )?
+        URGP=\d+ \s
+        (?: OPT \s \( [^)\s]+ \) \s )?
+       |
+        (?<proto>UDP) \s
+        SPT=(?<src_port>\d+) \s
+        DPT=(?<dst_port>\d+) \s
+        LEN=(?<udp_len>\d+) \s
+       |
+        (?<proto>ICMP) \s
+        TYPE=(?<icmp_type>\d+) \s
+        CODE=(?<icmp_code>\d) \s
+        # Some ICMP errors have an embedded packet header inside
+        (?:
+         ID=(?<icmp_id>\d+) \s
+         SEQ=(?<icmp_seq>\d+) \s
+        |
+         \[
+         SRC= (?<icmp_err_src_ip>[0-9.]{7,15}) \s
+         DST= (?<icmp_err_dst_ip>[0-9.]{7,15}) \s
+         .*
+         PROTO=(?<icmp_err_proto>[^ ]+) \s
          (?:
-          SEQ=(?<tcp_seq>\d+)\s
-          ACK=(?<tcp_ack>\d+)\s
+          SPT=(?<icmp_err_src_port>\d+) \s
+          DPT=(?<icmp_err_dst_port>\d+) \s
          )?
-         WINDOW=(?<proto_window_size>\d+)\s
-         RES=(?<pkt_res>\w+)?\s
-         (?<pkt_type>\w+)\s
-         (?<pkt_flag> (?:[A-Z]+\s)* )
-         URGP=(?<pkg_urgency>\d)\s
+         [^\]]*
+         \] .*
         )?
-       )?
+       |
+        (?<proto>ESP) \s
+        SPI=(?<esp_spi>0x[A-Fa-f0-9]+) \s
+       |
+        (?<proto>[^ ]+) \s
+        (?: (?<proto_extra>[^\s].*) \s )?
+       )
 
-       # ICMP is the next most likely protocol
-       (
-        TYPE=(?<pkt_icmp_type>\d+)\s
-        CODE=(?<pkt_icmp_code>\d+)\s
-        ID=(?<pkt_icmp_id>\d+)\s
-        SEQ=(?<pkt_icmp_seq>\d+)\s
+       # Output rules might have --log-uid applied
+       (?:
+        UID=(?<uid>[0-9]+) \s
+        GID=(?<gid>[0-9]+) \s
        )?
+       # Packet markings
+       (?: MARK=(?<pkt_mark>0x[A-Fa-f0-9]+) \s )?
+
+       # support arbitrary unknown suffixes rather than fail to match
+       (?<fw_unknown_suffix>.*)
        $
-    types: 'source_port:integer,dest_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer'
+    types: 'src_port:integer,dst_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer'
 
   - name: couchbase_json_log_nanoseconds
     # Various parsers for Couchbase Server logs

From 1d9ddbfa584ecf420b4f63e36d4099694ce5bc2e Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Wed, 19 Nov 2025 23:55:22 -0700
Subject: [PATCH 19/19] conf: parser: iptables: minor cleanups

---
 conf/parsers_extra.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
index ad073b2b247..c91df9ac78f 100644
--- a/conf/parsers_extra.yaml
+++ b/conf/parsers_extra.yaml
@@ -142,9 +142,9 @@ parsers:
        (?:
         MAC=
         (?:
-         (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+         (?<macdst>[0-9a-f]{2} (?: :[0-9a-f]{2}){5} )
          :
-         (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+         (?<macsrc>[0-9a-f]{2} (?: :[0-9a-f]{2}){5} )
          :
          # Ether type can be longer when processing incoming VLAN-tagged packets
          (?<ethtype>[0-9a-f]{2} (?::[0-9a-f]{2})+ )
@@ -194,7 +194,7 @@ parsers:
        |
         (?<proto>ICMP) \s
         TYPE=(?<icmp_type>\d+) \s
-        CODE=(?<icmp_code>\d) \s
+        CODE=(?<icmp_code>\d+) \s
         # Some ICMP errors have an embedded packet header inside
         (?:
          ID=(?<icmp_id>\d+) \s