regex101: fluentd + auditd

1st Alternative(^type=AVC msg=audit\((?<time>\w+).*: apparmor=\"(?<resolution>\w+)\" operation=\"(?<operation>\w+)\"( profile=\"(?<profile>[^ ]+)\"){0,1}( name=\"(?<name>[^ ]+)\"){0,1} pid=(?<pid>\d+) comm=\"{0,1}(?<comm>[^ ]+)\"{0,1}( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?|^type=(?<type>\w+) msg=audit\((?<time1>\w+).*: pid=(?<pid1>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'|type=NETFILTER_CFG msg=audit\((?<time2>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)|type=ANOM_PROMISCUOUS msg=audit\((?<time3>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*)

Group 1(^type=AVC msg=audit\((?<time>\w+).*: apparmor=\"(?<resolution>\w+)\" operation=\"(?<operation>\w+)\"( profile=\"(?<profile>[^ ]+)\"){0,1}( name=\"(?<name>[^ ]+)\"){0,1} pid=(?<pid>\d+) comm=\"{0,1}(?<comm>[^ ]+)\"{0,1}( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?|^type=(?<type>\w+) msg=audit\((?<time1>\w+).*: pid=(?<pid1>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'|type=NETFILTER_CFG msg=audit\((?<time2>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)|type=ANOM_PROMISCUOUS msg=audit\((?<time3>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*)

1st Alternative^type=AVC msg=audit\((?<time>\w+).*: apparmor=\"(?<resolution>\w+)\" operation=\"(?<operation>\w+)\"( profile=\"(?<profile>[^ ]+)\"){0,1}( name=\"(?<name>[^ ]+)\"){0,1} pid=(?<pid>\d+) comm=\"{0,1}(?<comm>[^ ]+)\"{0,1}( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?

^start of string

type=AVC msg=auditthe literal text type=AVC msg=audit (case sensitive)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

Group time(?<time>\w+)

\w+any word character, repeated at least once

.*any character (except for line terminators), repeated any number of times

: apparmor=the literal text : apparmor= (case sensitive)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group resolution(?<resolution>\w+)

\w+any word character, repeated at least once

\"the literal " (34₁₀ / 42₈ / 22₁₆)

operation=the literal text operation= (case sensitive)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group operation(?<operation>\w+)

\w+any word character, repeated at least once

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group 5( profile=\"(?<profile>[^ ]+)\"){0,1}

{0,1}repeats the group contents below at most once:

profile=the literal text profile= (case sensitive)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group profile(?<profile>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group 7( name=\"(?<name>[^ ]+)\"){0,1}

{0,1}repeats the group contents below at most once:

name=the literal text name= (case sensitive)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group name(?<name>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

pid=the literal text pid= (case sensitive)

Group pid(?<pid>\d+)

\d+a digit, repeated at least once

comm=the literal text comm= (case sensitive)

\"{0,1}optionally matches the literal " (34₁₀ / 42₈ / 22₁₆)

Group comm(?<comm>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\"{0,1}optionally matches the literal " (34₁₀ / 42₈ / 22₁₆)

Group 11( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?

?repeats the group contents below at most once:

requested_mask=the literal text requested_mask= (case sensitive)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group requested_mask(?<requested_mask>\w+)

\w+any word character, repeated at least once

\"the literal " (34₁₀ / 42₈ / 22₁₆)

denied_mask=the literal text denied_mask= (case sensitive)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group denied_mask(?<denied_mask>\w+)

\w+any word character, repeated at least once

\"the literal " (34₁₀ / 42₈ / 22₁₆)

fsuid=the literal text fsuid= (case sensitive)

Group fsuid(?<fsuid>\d+)

\d+a digit, repeated at least once

2nd Alternative^type=(?<type>\w+) msg=audit\((?<time1>\w+).*: pid=(?<pid1>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'

^start of string

type=the literal text type= (case sensitive)

Group type(?<type>\w+)

\w+any word character, repeated at least once

msg=auditthe literal text msg=audit (case sensitive)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

Group time1(?<time1>\w+)

\w+any word character, repeated at least once

.*any character (except for line terminators), repeated any number of times

: pid=the literal text : pid= (case sensitive)

Group pid1(?<pid1>\d+)

\d+a digit, repeated at least once

uid=the literal text uid= (case sensitive)

Group uid(?<uid>\d+)

\d+a digit, repeated at least once

the literal (32₁₀ / 40₈ / 20₁₆)

.*any character (except for line terminators), repeated any number of times

msg='the literal text msg=' (case sensitive)

Group message(?<message>.*)

.*any character (except for line terminators), repeated any number of times

'the literal ' (39₁₀ / 47₈ / 27₁₆)

3rd Alternativetype=NETFILTER_CFG msg=audit\((?<time2>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)

4th Alternativetype=ANOM_PROMISCUOUS msg=audit\((?<time3>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*

2nd Alternativetype=DAEMON\w+ msg=audit\((?<time4>\w+).*: (?<message1>.*)

3rd Alternativetype=CONFIG_CHANGE msg=audit\((?<time5>\w+).*: (?<message2>.*)

25 tokens

Regular Expression

(^type=AVC msg=audit\((?<time>\w+).*: apparmor=\"(?<resolution>\w+)\" operation=\"(?<operation>\w+)\"( profile=\"(?<profile>[^ ]+)\"){0,1}( name=\"(?<name>[^ ]+)\"){0,1} pid=(?<pid>\d+) comm=\"{0,1}(?<comm>[^ ]+)\"{0,1}( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?|^type=(?<type>\w+) msg=audit\((?<time1>\w+).*: pid=(?<pid1>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'|type=NETFILTER_CFG msg=audit\((?<time2>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)|type=ANOM_PROMISCUOUS msg=audit\((?<time3>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*)|type=DAEMON\w+ msg=audit\((?<time4>\w+).*: (?<message1>.*)|type=CONFIG_CHANGE msg=audit\((?<time5>\w+).*: (?<message2>.*)

New

type=DAEMON_START msg=audit(1450609493.002:6827): auditd start, ver=2.4 format=raw kernel=4.3.0 auid=4294967295 pid=2491 subj=unconfined  res=success