# Set 'debug: 1' globally to enable full debugging everywhere.
# valid 'debug' values are: yes, no, true, false, 1, 0.
# The values all enable or disable debugging at the current scope
# Debugging values are passed down scope global -> program -> (file, match, etc)
#debug: no

#program {
  # 'debug' is valid here
  #debug: no

  # Load patterns from a file.
  #load-patterns: "/usr/share/grok/patterns/base"

  # Read a file once
  #file "/tmp/messages" {
    #follow: no
    # 'debug' is valid here
    #debug: no
  #}

  # Follow a file (if the file is log-rotated, truncated, or appended)
  #file "/var/log/messages" {
    #follow: yes
  #}

  #match {
    # The 'debug' setting is valid almost anywhere and is scoped sanely.
    #debug: no

    # Example of a pattern
    #pattern: "%{SYSLOGBASE} .*authentication error for (illegal user)? %{WORD} from %{IPORHOST}"

    # You can only have 
    #reaction: "matchfound: %{@LINE}"

    # Valid shell values are 'stdout' or a command string to run.
    # Any reactions generated are written to this shell.
    #shell: stdout

    # Should writes to the 'shell' be flushed on write?
    # Default is no
    #flush: no
  #}
#}

# Another program. You can have multiple in a single config file.
#program {
  #load-patterns: "/usr/share/grok/patterns/base"
  
  # Run 'uptime' and every 15 seconds ...
  #exec "uptime" {
    #run-interval 15
  #}
  
  # ... and grab the 1-min load average
  # Match the first number after 'load average: ' and print it to stdout 
  #match {
    #pattern: "load average: %{NUMBER}"
    #reaction: "%{NUMBER%}
    #shell: "stdout"
    #flush: yes
  #}
#}

# Another program example
#program {
  #load-patterns: "/usr/share/grok/patterns/base"

  # Ping www.google.com every minute
  #exec "ping -c 1 -W 3 www.google.com 2> /dev/null" {
    #run-interval: 60
  #}

  # Output all the data we have in JSON format on a successful ping.
  #match {
    #pattern: "time=%{NUMBER:time}"
    #reaction: "%{@JSON}"
    #shell: "stdout"
    #flush: yes
  #}

  # "no-match" is executed if for every run of 'ping' no output is matched.
  #no-match {
    #reaction: "\"ERROR: Ping failed\""
    #shell: "stdout"
    #flush: yes
  #}
#}

# Another example program
#program {
  #load-patterns: "/usr/share/grok/patterns/base"

  # Run vmstat -s every 60 seconds
  #exec "vmstat -s" {
    #run-interval: 60
  #}

  # For every line of output that matches, run gmetric to advertise the value
  # (This is a ganglia monitoring utility)
  #match {
    #pattern: "%{NUMBER} %{DATA}$"

    # Pipe 'DATA' through the shelldqescape function so it can be safely
    # represented in doublequotes when passed to /bin/sh. This escapes
    # things like $ and "
    #reaction: "gmetric -n \"%{DATA|shelldqescape}\" -v %{NUMBER} -t uint32"
  #}
#}

#program {
  #load-patterns: "/usr/share/grok/patterns/base"
  #file "/b/logs/auth.log.scorn"
  #match {
    #pattern: "%{SYSLOGBASE} Accepted %{NOTSPACE:method} for %{DATA:user} from %{IPORHOST:client} port %{INT:port}"
    #reaction: "%{@JSON}"
    #shell: "stdout"
  #}
#
  #match {
    #pattern: "%{SYSLOGBASE} Illegal user %{DATA:user} from %{IPORHOST:client}"
    #reaction: "%{@JSON}"
    #shell: "stdout"
  #}
#
  #match {
    #pattern: "%{SYSLOGBASE} Failed \S+ for %{DATA:user} from %{IPORHOST:client}"
    #reaction: "%{@JSON}"
    #shell: "stdout"
  #}
#}
