github.com/crowdsecurity/crowdsec@v1.6.1/config/patterns/mcollective (about)

     1  # Remember, these can be multi-line events.
     2  MCOLLECTIVE ., \[%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}\]%{SPACE}%{LOGLEVEL:event_level}
     3  
     4  MCOLLECTIVEAUDIT %{TIMESTAMP_ISO8601:timestamp}: