github.com/crowdsecurity/crowdsec@v1.6.1/pkg/parser/tests/base-grok-no-subnode/base-grok.yaml (about)

     1  filter: "evt.Line.Labels.type == 'testlog'"
     2  debug: true
     3  onsuccess: next_stage
     4  name: tests/base-grok
     5  pattern_syntax:
     6    MYCAP2: ".*"
     7  grok:
     8    pattern: ^xxheader %{MYCAP2:extracted_value} trailing stuff$
     9    apply_on: Line.Raw
    10  statics:
    11    - meta: log_type
    12      value: parsed_testlog
    13