diff --git a/modules/log_processor/files/classify-log.crm b/modules/log_processor/files/classify-log.crm index a2e7a22945..66b02bc48a 100755 --- a/modules/log_processor/files/classify-log.crm +++ b/modules/log_processor/files/classify-log.crm @@ -57,6 +57,39 @@ learn [:_nl:] (:*:prefix:/FAILURE.css) match (:timestamp:) /^[-.0-9 |:]+/ alter (:timestamp:) // } + { + # Don't treat UUIDs as uniquely special. + match (:uuidtoken:) /[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}/ + alter (:uuidtoken:) /UUIDTOKEN/ + { + match (:uuidtoken:) /[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}/ + alter (:uuidtoken:) /UUIDTOKEN/ + # Loop to replace all TOKENS in line + liaf + } + } + { + # Don't treat IDs as uniquely special. + match (:idtoken:) /[[:xdigit:]]{32,40}/ + alter (:idtoken:) /IDTOKEN/ + { + match (:idtoken:) /[[:xdigit:]]{32,40}/ + alter (:idtoken:) /IDTOKEN/ + # Loop to replace all TOKENS in line + liaf + } + } + { + # Don't treat IDs as uniquely special. + match (:numtoken:) /-[[:digit:]]{7,}/ + alter (:numtoken:) /-NUMTOKEN/ + { + match (:numtoken:) /-[[:digit:]]{7,}/ + alter (:numtoken:) /-NUMTOKEN/ + # Loop to replace all TOKENS in line + liaf + } + } # Train on the line learn (:*:prefix:/:*:target:.css) # Classify the line to see if it looks more like a SUCCESS or FAILURE line