<commit_before>package com.wizecore.graylog2.plugin;

import java.util.Map;

import org.graylog2.plugin.Message;
import org.graylog2.syslog4j.SyslogIF;

/**
 * Using CEF format
 */

/*
 * http://blog.rootshell.be/2011/05/11/ossec-speaks-arcsight/
 * 
 * 
 * CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension

CEF:0|ArcSight|Logger|5.0.0.5355.2|sensor:115|Logger Internal Event|1|\
cat=/Monitor/Sensor/Fan5 cs2=Current Value cnt=1 dvc=10.0.0.1 cs3=Ok \
cs1=null type=0 cs1Label=unit rt=1305034099211 cs3Label=Status cn1Label=value \
cs2Label=timeframe
 */
public class CEFSender implements MessageSender {

	@Override
	public void send(SyslogIF syslog, int level, Message msg) {
		StringBuilder out = new StringBuilder();
		PlainSender.appendHeader(msg, out);
		out.append("CEF:0|ArcSight|Logger|5.0.0.5355.2|log:1|");
		String str = msg.getMessage();
		if (str.contains("|")) {
			str = str.replace("|", "");
		}
		out.append(str);
		out.append("|").append(level) .append("|"); // severity
		Map<String, Object> fields = msg.getFields();
		boolean have = false;
		for (String k: fields.keySet()) {
			Object v = fields.get(k);
			if (!k.equals("message") && !k.equals("full_message")) {
    			String s = v != null ? v.toString() : "null";
    			if (have) {
					have = true;
				}
				s = s.replace("\\", "\\\\");
				s = s.replace("=", "\\=");
				s = s.replace("\r", "");
				s = s.replace("\n", "\\n");
				out.append(k).append('=').append(s);
			}
		}

		syslog.log(level, out.toString());
	}
}<commit_msg>- Don`t add syslog header - Use values for CEF field Device Vendor|Device Product|Device Version specific to graylog-output-syslog plugin - Space separated params in CEF Extension field<commit_after>package com.wizecore.graylog2.plugin;

import java.util.Map;

import org.graylog2.plugin.Message;
import org.graylog2.syslog4j.SyslogIF;

/**
 * Using CEF format
 */

/*
 * http://blog.rootshell.be/2011/05/11/ossec-speaks-arcsight/
 * 
 * 
 * CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension

CEF:0|ArcSight|Logger|5.0.0.5355.2|sensor:115|Logger Internal Event|1|\
cat=/Monitor/Sensor/Fan5 cs2=Current Value cnt=1 dvc=10.0.0.1 cs3=Ok \
cs1=null type=0 cs1Label=unit rt=1305034099211 cs3Label=Status cn1Label=value \
cs2Label=timeframe
 */
public class CEFSender implements MessageSender {

	@Override
	public void send(SyslogIF syslog, int level, Message msg) {
		StringBuilder out = new StringBuilder();
		// Header:
		// CEF:Version|Device Vendor|Device Product|Device Version|
		out.append("CEF:0|Graylog|graylog-output-syslog:cefsender|2.1.1|");
		// Device Event Class ID
		out.append("log:1");
		out.append("|");
		// Name
		String str = msg.getMessage();
		if (str.contains("|")) {
			str = str.replace("|", "");
		}
		out.append(str);
		// Severity
		out.append("|").append(level) .append("|"); 
		// Extension
		Map<String, Object> fields = msg.getFields();
		boolean have = false;
		for (String k: fields.keySet()) {
			Object v = fields.get(k);
			if (!k.equals("message") && !k.equals("full_message")) {
    			String s = v != null ? v.toString() : "null";
				s = s.replace("\\", "\\\\");
				s = s.replace("=", "\\=");
				s = s.replace("\r", "");
				s = s.replace("\n", "\\n");
				if (have) {
					out.append(" ");
				}
				out.append(k).append('=').append(s);
				have = true;
			}
		}

		syslog.log(level, out.toString());
	}
}
{'fraction_non_alphanumeric': 0.18635703918722787, 'fraction_numerical': 0.0351233671988389, 'mean_word_length': 3.6948228882833787, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 5, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6886305', 'n_tokens_mistral': 1421, 'n_tokens_neox': 1265, 'n_words': 244}