Skip to content

Conversation

@hlein
Copy link
Owner

@hlein hlein commented Nov 24, 2025


Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

  • Example configuration file for the change <- the changes are configs
  • Debug log output from testing the change
  • [N/A] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

  • [N/A] Run local packaging test showing all targets (including any new ones) build.
  • [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

  • [N/A] Documentation required for this feature

Backporting

  • [N/A] Backport to latest stable release.

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

@hlein
Copy link
Owner Author

hlein commented Nov 24, 2025

Gathered some sample logs, ran them through fluent-bit w/these parsers, compared number of input lines to number of output lines (i.e. matched lines).

$ for A in firewall proxy dhcp ovpn logins other ; do wc -l mikrotik_${A}.numbered && cat mikrotik_${A}.numbered | fluent-bit -q -R parsers_mikrotik.yaml -i stdin -p parser=mikrotik-${A} -o stdout -p format=json_lines | jq -r '.log_seq' | sort -n > matched_${A}.txt ; wc -l matched_${A}.txt ; done
firewall
620784060 mikrotik_firewall.numbered
620784060 matched_firewall.txt
proxy
132515 mikrotik_proxy.numbered
132515 matched_proxy.txt
dhcp
860 mikrotik_dhcp.numbered
860 matched_dhcp.txt
ovpn
3794 mikrotik_ovpn.numbered
3794 matched_ovpn.txt
logins
8 mikrotik_logins.numbered
8 matched_logins.txt
other
2003 mikrotik_other.numbered
2003 matched_other.txt

Signed-off-by: Hank Leininger <hlein@korelogic.com>
@hlein hlein force-pushed the parsers-add-mikrotik branch from 5dcefa1 to 9724468 Compare November 24, 2025 22:41
@hlein hlein changed the base branch from parser-fixes to master November 24, 2025 22:42
@hlein
Copy link
Owner Author

hlein commented Nov 24, 2025

Simplified this since it is separate from other changes. Ready to be a PR against upstream.

@hlein hlein closed this Nov 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants