# NAME

Parse::Syslog::Line - Simple syslog line parser

# VERSION

version 2.7

# SYNOPSIS

I wanted a very simple log parser for network based syslog input.
Nothing existed that simply took a line and returned a hash ref all
parsed out.

    use Parse::Syslog::Line qw(parse_syslog_line);

    $Parse::Syslog::Line::DateTimeCreate = 1;

    my $href = parse_syslog_line( $msg );
    #
    # $href = {
    #       preamble        => '13',
    #       priority        => 'notice',
    #       priority_int    => 5,
    #       facility        => 'user',
    #       facility_int    => 8,
    #       date            => 'YYYY-MM-DD',
    #       time            => 'HH::MM:SS',
    #       epoch           => 1361095933,
    #       datetime_str    => 'YYYY-MM-DD HH:MM:SS',
    #       datet_str       => 'YYYY-MM-DD HH:MM:SS',
    #       datetime_obj    => new DateTime(), # If installed
    #       datetime_raw    => 'Feb 17 11:12:13'
    #       date_raw        => 'Feb 17 11:12:13'
    #       date_raw        => 'Feb 17 11:12:13'
    #       host_raw        => 'hostname',  # Hostname as it appeared in the message
    #       host            => 'hostname',  # Hostname without domain
    #       domain          => 'blah.com',  # if provided
    #       program_raw     => 'sshd(blah)[pid]',
    #       program_name    => 'sshd',
    #       program_sub     => 'pam_unix',
    #       program_pid     => 20345,
    #       content         => 'the rest of the message'
    #       message         => 'program[pid]: the rest of the message',
    #       message_raw     => 'The message as it was passed',
    #       ntp             => 'ok',           # Only set for Cisco messages
    # };
    ...

# EXPORT

Exported by default:
       parse\_syslog\_line( $one\_line\_of\_syslog\_message );

Optional Exports:
  :preamble
       preamble\_priority
       preamble\_facility

    :constants
         %LOG_FACILITY
         %LOG_PRIORITY

# VARIABLES

## ExtractProgram

If this variable is set to 1 (the default), parse\_syslog\_line() will try it's
best to extract a "program" field from the input.  This is the most expensive
set of regex in the module, so if you don't need that pre-parsed, you can speed
the module up significantly by setting this variable.

Vendors who do proprietary non-sense with their syslog formats are to blame for
this setting.

Usage:

    $Parse::Syslog::Line::ExtractProgram = 0;

## DateTimeCreate

If this variable is set to 1 (the default), a DateTime object will be
returned in the $m->{datetime\_obj} field.  Otherwise, this will be skipped.

Usage:

    $Parse::Syslog::Line::DateTimeCreate = 0;

## EpochCreate

If this variable is set to 1, the number of seconds from UNIX epoch
will be returned in the $m->{epoch} field.  If DateTimeCreate is
not set, the parser will use `HTTP::Date` to perform the parsing

Usage:

    $Parse::Syslog::Line::EpochCreate = 1;

## PruneRaw

This variable defaults to 0, set to 1 to delete all keys in the return hash ending in "\_raw"

Usage:

    $Parse::Syslog::Line::PruneRaw = 1;

## PruneEmpty

This variable defaults to 0, set to 1 to delete all keys in the return hash which are undefined.

Usage:

    $Parse::Syslog::Line::PruneEmpty = 1;

## PruneFields

This should be an array of fields you'd like to be removed from the hash reference.

Usage:

    @Parse::Syslog::Line::PruneFields = qw(date_str date_raw facility_int priority_int);

## RegexSet

Allows the use of different regex sets, the default is stable.  This is mostly a developer level
feature to allow easy benchmarking of features against previous release.

Usage:

    $Parse::Syslog::Line::RegexSet = 'devel';

# FUNCTIONS

## parse\_syslog\_line

Returns a hash reference of syslog message parsed data.

## preamble\_priority

Takes the Integer portion of the syslog messsage and returns
a hash reference as such:

    $prioRef = {
        'preamble'  => 13
        'as_text'   => 'notice',
        'as_int'    => 5,
    };

## preamble\_facility

Takes the Integer portion of the syslog messsage and returns
a hash reference as such:

    $facRef = {
        'preamble'  => 13
        'as_text'   => 'user',
        'as_int'    => 8,
    };

# DEVELOPMENT

This module is developed with Dist::Zilla.  To build from the repository, use Dist::Zilla:

    dzil authordeps |cpanm
    dzil build
    dzil test

- Github Page

    [http://github.com/reyjrar/Parse-Syslog-Line](http://github.com/reyjrar/Parse-Syslog-Line)

- AnnoCPAN: Annotated CPAN documentation

    [http://annocpan.org/dist/Parse-Syslog-Line](http://annocpan.org/dist/Parse-Syslog-Line)

- CPAN Ratings

    [http://cpanratings.perl.org/d/Parse-Syslog-Line](http://cpanratings.perl.org/d/Parse-Syslog-Line)

- RT: CPAN's request tracker

    [http://rt.cpan.org/NoAuth/Bugs.html?Dist=Parse-Syslog-Line](http://rt.cpan.org/NoAuth/Bugs.html?Dist=Parse-Syslog-Line)

- Search CPAN

    [http://search.cpan.org/dist/Parse-Syslog-Line](http://search.cpan.org/dist/Parse-Syslog-Line)

# ACKNOWLEDGEMENTS

- Mattia Barbon

    Contribution of patch to support faster HTTP::Date routines

- Alexander Hartmaier

    Contribution of log samples for Cisco devices and testing

- Shawn Wilson

    Contribution of patch to support custom date parsing function

# AUTHOR

Brad Lhotsky <brad@divisionbyzero.net>

# COPYRIGHT AND LICENSE

This software is Copyright (c) 2012 by Brad Lhotsky.

This is free software, licensed under:

    The (three-clause) BSD License
