General Electric CIMPLICITY

3/4/2021|6:04:10 AM|Success|6544|MRTUSI_RP|Main|0|Program shutdown completed successfully.

# A regular expression defined as a constant to read the content of the logs
define COR_RECSTAT_CSV_REGEX    /(?x)^(\d+.\d+.\d+)\|(\d+.\d+.\d+.\w+)\|\
                                (?<Status>\w+)\|(?<PID>\d+)\|(?<Process>.*?)\|\
                                (?<Procedure>.*?)\|(?<Reference>\d+)\|\
                                (?<Message>.*?)\|(?<Source>.*?)\|\
                                (?<Code>\d+)/
# Part of the log path defined as a constant
define PRJ_PATH                 C:\Users\Administrator\Documents\DummyPrj\log

<Extension json>
    Module        xm_json
</Extension>

<Extension multiline_status>
    Module        xm_multiline
    # Regular expression to look for the header of the message
    HeaderLine    /^\d+.\d+.\d+\|\d+.\d+.\d+.\w+/
</Extension>

<Input from_file>
    Module        im_file
    File          '%PRJ_PATH%\COR_RECSTAT.CSV'
    InputType     multiline_status
    <Exec>
        # Replaces unwanted characters
        $raw_event = replace($raw_event, "\r", "");
        $raw_event = replace($raw_event, "\n", "");

        # Matches the events with a regular expression
        if $raw_event =~ %COR_RECSTAT_CSV_REGEX%
        {
            # Creates the timestamp
            $EventTime = strptime($1 + $2, "%m/%d/%Y %T %p");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-06T05:17:38.586649-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Code": "6",
  "Message": "Program shutdown completed successfully.",
  "PID": "6544",
  "Procedure": "Main",
  "Process": "MRTUSI_RP",
  "Reference": "0",
  "Source": "COR_MRTUSI_ERR",
  "Status": "Success",
  "EventTime": "2021-03-04T06:04:10.000000-08:00"
}

3/8/2021   4:04:18 AM    Success 3228       PM_MCP                           ProjectStop                       0
Project DUMMYPRJ is stopped.
Error of type: COR_PM_ERR,  Code: 0

# A regular expression defined as a constant to read the content of the logs
define COR_RECSTAT_TXT_REGEX  /(?x)^(\d+.\d+.\d+)\s+(\d+.\d+.\d+.\w+)\
                              \s+(?<Status>\w+)\s+(?<PID>\d+)\s+(?<Process>\w+)\
                              \s+(?<Procedure>.*?)\s+(?<Reference>\d+)\s+\
                              (?<Message>.*?)\s+(?:Error\s+of\s+type\:\s+)\
                              (?<Source>.*?)\,\s+(?:Code\:\s+)(?<Code>\d+)/
# Part of the log path defined as a constant
define PRJ_PATH               C:\Users\Administrator\Documents\DummyPrj\log

<Extension json>
    Module        xm_json
</Extension>

<Extension multiline_status_text>
    Module        xm_multiline
    # Regular expression to look for the header of the message
    HeaderLine    /^\d+.\d+.\d+\s+\d+.\d+.\d+.\w+/
</Extension>

<Input from_file>
    Module        im_file
    File          '%PRJ_PATH%\COR_RECSTAT.txt'
    InputType     multiline_status_text
    <Exec>
        # Replaces unwanted characters
        $raw_event = replace($raw_event, "\r", " ");
        $raw_event = replace($raw_event, "\n", " ");

        # Matches the events with a regular expression
        if $raw_event =~ %COR_RECSTAT_TXT_REGEX%
        {
            # Creates the timestamp
            $EventTime = strptime($1 + $2, "%m/%d/%Y %T %p");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-08T05:34:02.040898-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Code": "0",
  "Message": "Project DUMMYPRJ is stopped.",
  "PID": "3228",
  "Procedure": "ProjectStop",
  "Process": "PM_MCP",
  "Reference": "0",
  "Source": "COR_PM_ERR",
  "Status": "Success",
  "EventTime": "2021-03-08T04:04:18.000000-08:00"
}

Mon Mar  8 20:31:26 2021 failure       1892       CfgCab bGetTADBConnect     83
item does not exist
 dbms_def $TADB
Error of type COR_SC_ERR:
source 130   code 111

# A regular expression defined as a constant to read the content of the logs
define COR_STATUS_REGEX     /(?x)^(\w+\s+\w+\s+\d+\s+\d+.\d+.\d+\s+\d+)\s+\
                            (?<Status>\w+)\s+(?<PID>\d+)\s+\
                            (?<Process>\<.*?\>|.*?)\s+(?<Procedure>.*?)\s+\
                            (?<Reference>\d+)\s+(?<Message>.*?)\s+\
                            (?:Error\s+of\s+type\s+)(?<Source>.*?)\:\s+\
                            (?:source\s+)(?<SourceCode>\d+)\s+(?:code\s+)\
                            (?<Code>\d+)/
# Part of the log path defined as a constant
define PRJ_PATH             C:\Users\Administrator\Documents\DummyPrj\log

<Extension json>
    Module        xm_json
</Extension>

<Extension multiline_process>
    Module        xm_multiline
    # A regular expression that matches the header (first line) of an event
    HeaderLine    /^\w+\s+\w+\s+\d+\s+\d+.\d+.\d+\s+\d+/
</Extension>

<Input from_file>
    Module        im_file
    File          '%PRJ_PATH%\COR_STATUS.LOG'
    InputType     multiline_process
    <Exec>
        # Replaces unwanted characters
        $raw_event = replace($raw_event, "\r", " ");
        $raw_event = replace($raw_event, "\n", " ");
        $raw_event =~ s/\s{2,}/ /g;

        # Matches the events with a regular expression
        if $raw_event =~ %COR_STATUS_REGEX%
        {
            # Creates the timestamp
            $EventTime = strptime($1, "%a %b %e %T %Y");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-08T23:26:46.097086-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Code": "111",
  "Message": "item does not exist dbms_def $TADB",
  "PID": "1892",
  "Procedure": "bGetTADBConnect",
  "Process": "CfgCab",
  "Reference": "83",
  "Source": "COR_SC_ERR",
  "SourceCode": "130",
  "Status": "failure",
  "EventTime": "2021-03-08T20:31:26.000000-08:00"
}

2021-03-11 04:50:14.415 Started Modbus/TCP Slave Interface (MTCPSI_RP) - using IP address 127.0.0.1

2021-03-11 04:50:17.370 -> [id = 1216] 13F90000000F 03030C04D211D722C5000000000000

# Regular expressions defined to read the contents of log entries
define MTCPSI_HEADER_REGEX  /(?x)^(\d+.\d+.\d+.\d+.\d+.\d+.\d+)\s+\
                            (?<Message>.*)/
define MTCPSI_REGEX         /(?x)^(\d+.\d+.\d+.\d+.\d+.\d+.\d+)\s+\
                            (?<Direction>[\<\>\-]*)\s+(?:\[id\s+\=)\s+\
                            (?<ConnectionID>\d+)\]\s+(?<Data>[\d\w\s]*)\s+/
# Part of the log path defined as a constant
define PRJ_PATH             C:\Users\Administrator\Documents\DummyPrj\log

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PRJ_PATH%\MTCPSI_RP.err'
    <Exec>
        # Matches the events with a regular expression
        if ($raw_event =~ %MTCPSI_REGEX%) or
           ($raw_event =~ %MTCPSI_HEADER_REGEX%)
        {
            # Creates the timestamp
            $EventTime = parsedate($1);
            # Converts to JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-11T04:50:14.609195-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "Started Modbus/TCP Slave Interface (MTCPSI_RP) - using IP address 127.0.0.1",
  "EventTime": "2021-03-11T04:50:14.415000-08:00"
}

{
  "EventReceivedTime": "2021-03-11T04:50:17.621151-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "ConnectionID": "1216",
  "Data": "13F90000000F 03030C04D211D722C5000000000000",
  "Direction": "->",
  "EventTime": "2021-03-11T04:50:17.370000-08:00"
}

[2021-03-09 19:15:38.568] [CIMConfigService] [info] [CimConfigService.cpp:165] CIMPLICITY Config REST API is available at https://localhost:4855/cim-config/v1

# A regular expression for reading the contents of the logs
define WEBCONF_REGEX    /(?x)^\[(\d+.\d+.\d+.\d+.\d+.\d+.\d+)\]\s+\
                        \[(?<Service>\w+)\]\s+\[(?<Status>\w+)\]\s+\
                        \[(?<Loader>.*?)\]\s(?<Message>.*)/
# Part of the log path defined as a constant
define PROFICY_PATH     C:\Program Files (x86)\Proficy\Proficy CIMPLICITY\log

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROFICY_PATH%\cim_config_service.log'
    <Exec>
        # Matches the events with a regular expression
        if $raw_event =~ %WEBCONF_REGEX%
        {
            # Creates the timestamp
            $EventTime = parsedate($1);
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-09T21:15:49.428591-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Loader": "CimConfigService.cpp:165",
  "Message": "CIMPLICITY Config REST API is available at https://localhost:4855/cim-config/v1",
  "Service": "CIMConfigService",
  "Status": "info",
  "EventTime": "2021-03-09T19:15:38.568000-08:00"
}

"03/10/2021 00:48:20.361","1200619520","1249"

# A regular expression defined as a constant to read the content of the logs
define PERFDATA_REGEX   /(?x)^\"(\d+.\d+.\d+.\d+.\d+.\d+).\d+\"\,\
                        \"(?<Process_PrivateBytes_Total>\d+)\"\,\
                        \"(?<Objects_Threads>\d+)\"/
# Part of the log path defined as a constant
define PROFICY_PATH     C:\Program Files (x86)\Proficy\Proficy CIMPLICITY\log

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROFICY_PATH%\PERFDATA_*_DATA.CSV'
    <Exec>
        # Matches the events with a regular expression
        if $raw_event =~ %PERFDATA_REGEX%
        {
            # Creates the timestamp
            $EventTime = strptime($1, "%m/%d/%Y %T");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-10T03:06:50.213183-08:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Objects_Threads": "1249",
  "Process_PrivateBytes_Total": "1200619520",
  "EventTime": "2021-03-10T00:48:20.000000-08:00"
}

20210314.0725577939|OPC_KEP|TOOLKIT|[DEVICE] INI parameter [TraceLevel] Value [2]|0x00000000(The operation completed successfully. )|||||0x0000|0x00000000|04097

# A regular expression defined as a constant to read the content of the logs
define OPCTRC_REGEX     /(?x)^(\d+)\.(\d{6})\d+\|(?<DeviceID>.*?)\|\
                        (?<ThreadID>.*?)\|(?<Message>.*?)\|(?<ResultCode>.*?)\|\
                        (?<GroupID>.*?)\|(?<PointID>.*?)\|(?<PointAddress>.*?)\|\
                        (?<PointValue>.*?)\|(?<PointQuality>.*?)\|\
                        (?<TraceMessageID>.*?)\|(?<TraceMessageGroupID>.*)/
# Part of the log path defined as a constant
define PRJ_PATH         C:\Users\Administrator\Documents\DummyPrj\log

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PRJ_PATH%\MASTER_OPC_*_OPC_KEP.LOG'
    <Exec>
        # Matches the events with a regular expression
        if $raw_event =~ %OPCTRC_REGEX%
        {
            # Creates the timestamp
            $EventTime = strptime($1 + $2, "%Y%m%d%H%M%S");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-14T07:25:59.316562-07:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "DeviceID": "OPC_KEP",
  "GroupID": "",
  "Message": "[DEVICE] INI parameter [TraceLevel] Value [2]",
  "PointAddress": "",
  "PointID": "",
  "PointQuality": "0x0000",
  "PointValue": "",
  "ResultCode": "0x00000000(The operation completed successfully. )",
  "ThreadID": "TOOLKIT",
  "TraceMessageGroupID": "04097",
  "TraceMessageID": "0x00000000",
  "EventTime": "2021-03-14T07:25:57.000000-07:00"
}

3/15/2021	"04:21:34"	:277	Channel	CH_1	Error		RefreshChannelStatus: iResult = 0 [Socket Error (RefreshChannelStatus) - Socket Still Connecting (Error Code = 0)]

# A regular expression defined as a constant to read the content of the logs
define DNP_REGEX    /(?x)^(\d+.\d+.\d+)\s+\"(\d+.\d+.\d+)\"\s+\:\d+\s+\
                    (?<Source>.*?(?=\s+\w+\s{2}))\s+(?<EventType>\w+)\s+\
                    (?<Message>.*)/
# Part of the log path defined as a constant
define DNP_PATH     C:\Program Files (x86)\Proficy\Proficy CIMPLICITY\exe\DNP_Logs

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%DNP_PATH%\dnp_20210315_0018.log'
    <Exec>
        # Replaces unwanted characters
        $raw_event = replace($raw_event, "\t", " ");
        # Matches the events with a regular expression
        if $raw_event =~ %DNP_REGEX%
        {
            # Creates the timestamp
            $EventTime = strptime($1 + $2, "%m/%d/%Y %T");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-15T04:30:36.589913-07:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "EventType": "Error",
  "Message": "RefreshChannelStatus: iResult = 0 [Socket Error (RefreshChannelStatus) - Socket Still Connecting (Error Code = 0)]",
  "Source": "Channel CH_1",
  "EventTime": "2021-03-15T04:21:34.000000-07:00"
}

2020 08 20 04:29:34.198     SOE DNP_SIM.2.3.0,81,2020 08 20 14:29:33.000

# A regular expression defined as a constant to read the content of the logs
define DNPSOE_REGEX /(?x)^(\d+.\d+.\d+.\d+.\d+.\d+)\.\d+\s+(?<MessageType>\w+)\
                    \s+(?<Address>.*?)\,(?<RawValue>.*?)\,(.*?)\.\d+/
# Part of the log path defined as a constant
define DNP_PATH     C:\Program Files (x86)\Proficy\Proficy CIMPLICITY\exe\DNP_Logs

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%DNP_PATH%\dnp_soe**.log'
    <Exec>
        # Matches the events with a regular expression
        if $raw_event =~ %DNPSOE_REGEX%
        {
            # Creates the timestamps
            $EventTime = strptime($1, "%Y %m %d %T");
            $SOE_TimeStamp = strptime($5, "%Y %m %d %T");
            # Formats the result as JSON
            to_json();
        }
        # Discard event if it doesn't match a/the regular expression
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2021-03-15T21:10:16.231804-07:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Address": "DNP_SIM.2.3.0",
  "MessageType": "SOE",
  "RawValue": "81",
  "EventTime": "2020-08-20T04:29:34.000000-07:00",
  "SOE_TimeStamp": "2020-08-20T14:29:33.000000-07:00"
}

# --------------- REGULAR EXPRESSIONS FOR PARSING DATA -------------------------

define COR_RECSTAT_CSV_REGEX    /(?x)^(\d+.\d+.\d+)\|(\d+.\d+.\d+.\w+)\|\
                                (?<Status>\w+)\|(?<PID>\d+)\|(?<Process>.*?)\|\
                                (?<Procedure>.*?)\|(?<Reference>\d+)\|\
                                (?<ErrorMessage>.*?)\|(?<Source>.*?)\|\
                                (?<Code>\d+)/

define COR_RECSTAT_TXT_REGEX    /(?x)^(\d+.\d+.\d+)\s+(\d+.\d+.\d+.\w+)\
                                \s+(?<Status>\w+)\s+(?<PID>\d+)\s+\
                                (?<Process>\w+)\s+(?<Procedure>.*?)\s+\
                                (?<Reference>\d+)\s+(?<Message>.*?)\s+\
                                (?:Error\s+of\s+type\:\s+)(?<Source>.*?)\,\
                                \s+(?:Code\:\s+)(?<Code>\d+)/

define COR_STATUS_REGEX         /(?x)^(\w+\s+\w+\s+\d+\s+\d+.\d+.\d+\s+\d+)\s+\
                                (?<Status>\w+)\s+(?<PID>\d+)\s+\
                                (?<Process>\<.*?\>|.*?)\s+(?<Procedure>.*?)\s+\
                                (?<Reference>\d+)\s+(?<Message>.*?)\s+\
                                (?:Error\s+of\s+type\s+)(?<Source>.*?)\:\s+\
                                (?:source\s+)(?<SourceCode>\d+)\s+(?:code\s+)\
                                (?<Code>\d+)/

define MTCPSI_HEADER_REGEX      /(?x)^(\d+.\d+.\d+.\d+.\d+.\d+.\d+)\s+\
                                (?<Message>.*)/

define MTCPSI_REGEX             /(?x)^(\d+.\d+.\d+.\d+.\d+.\d+.\d+)\s+\
                                (?<Direction>[\<\>\-]*)\s+(?:\[id\s+\=)\s+\
                                (?<ConnectionID>\d+)\]\s+(?<Data>[\d\w\s]*)\s+/

define WEBCONF_REGEX            /(?x)^\[(\d+.\d+.\d+.\d+.\d+.\d+.\d+)\]\s+\
                                \[(?<Service>\w+)\]\s+\[(?<Status>\w+)\]\s+\
                                \[(?<Loader>.*?)\]\s(?<Message>.*)/

define PERFDATA_REGEX           /(?x)^\"(\d+.\d+.\d+.\d+.\d+.\d+).\d+\"\,\
                                \"(?<Process_PrivateBytes_Total>\d+)\"\,\
                                \"(?<Objects_Threads>\d+)\"/

define OPCTRC_REGEX             /(?x)^(\d+)\.(\d{6})\d+\|(?<DeviceID>.*?)\|\
                                (?<ThreadID>.*?)\|(?<Message>.*?)\|\
                                (?<ResultCode>.*?)\|(?<GroupID>.*?)\|\
                                (?<PointID>.*?)\|(?<PointAddress>.*?)\|\
                                (?<PointValue>.*?)\|(?<PointQuality>.*?)\|\
                                (?<TraceMessageID>.*?)\|\
                                (?<TraceMessageGroupID>.*)/

define DNP_REGEX                /(?x)^(\d+.\d+.\d+)\s+\"(\d+.\d+.\d+)\"\s+\:\
                                \d+\s+(?<Source>.*?(?=\s+\w+\s{2}))\s+\
                                (?<EventType>\w+)\s+(?<Message>.*)/

define DNPSOE_REGEX	            /(?x)^(\d+.\d+.\d+.\d+.\d+.\d+)\.\d+\s+\
                                (?<MessageType>\w+)\s+(?<Address>.*?)\,\
                                (?<RawValue>.*?)\,(.*?)\.\d+/

# -------------------------- PATHS TO LOG FILES --------------------------------

define PRJ_PATH   C:\Users\Administrator\Documents\DummyPrj\log

define PROF_PATH  C:\Program Files (x86)\Proficy\Proficy CIMPLICITY\log

define DNP_PATH   C:\Program Files (x86)\Proficy\Proficy CIMPLICITY\exe\DNP_Logs

# -------------------------- EXTENSION MODULES ---------------------------------

<Extension json>
    Module        xm_json
</Extension>

<Extension multiline_recstat_csv>
    Module        xm_multiline
    HeaderLine    /^\d+.\d+.\d+\|\d+.\d+.\d+.\w+/
</Extension>

<Extension multiline_recstat_text>
    Module        xm_multiline
    HeaderLine    /^\d+.\d+.\d+\s+\d+.\d+.\d+.\w+/
</Extension>

<Extension multiline_cor_status>
    Module        xm_multiline
    HeaderLine    /^\w+\s+\w+\s+\d+\s+\d+.\d+.\d+\s+\d+/
</Extension>

# -------------------------- INPUT MODULES -------------------------------------

<Input recstat_csv>
    Module        im_file
    File          '%PRJ_PATH%\COR_RECSTAT.CSV'
    InputType     multiline_recstat_csv
    <Exec>
        $raw_event = replace($raw_event, "\r", "");
        $raw_event = replace($raw_event, "\n", "");
        if $raw_event =~ %COR_RECSTAT_CSV_REGEX%
        {
            $EventTime = strptime($1 + $2, "%m/%d/%Y %T %p");
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input recstat_text>
    Module        im_file
    File          '%PRJ_PATH%\COR_RECSTAT.txt'
    InputType     multiline_recstat_text
    <Exec>
        $raw_event = replace($raw_event, "\r", " ");
        $raw_event = replace($raw_event, "\n", " ");
        if $raw_event =~ %COR_RECSTAT_TXT_REGEX%
        {
            $EventTime = strptime($1 + $2, "%m/%d/%Y %T %p");
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input cor_status>
    Module        im_file
    File          '%PRJ_PATH%\COR_STATUS.LOG'
    InputType     multiline_cor_status
    <Exec>
        $raw_event = replace($raw_event, "\r", " ");
        $raw_event = replace($raw_event, "\n", " ");
        $raw_event =~ s/\s{2,}/ /g;
        if $raw_event =~ %COR_STATUS_REGEX%
        {
            $EventTime = strptime($1, "%a %b %e %T %Y");
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input protocol_stack_trace>
    Module        im_file
    File          '%PRJ_PATH%\MTCPSI_RP.err'
    <Exec>
        if ($raw_event =~ %MTCPSI_REGEX%) or
           ($raw_event =~ %MTCPSI_HEADER_REGEX%)
        {
            $EventTime = parsedate($1);
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input web_conf>
    Module        im_file
    File          '%PROF_PATH%\cim_config_service.log'
    <Exec>
        if $raw_event =~ %WEBCONF_REGEX%
        {
            $EventTime = parsedate($1);
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input perfdata>
    Module        im_file
    File          '%PROF_PATH%\PERFDATA_*_DATA.CSV'
    <Exec>
        if $raw_event =~ %PERFDATA_REGEX%
        {
            $EventTime = strptime($1, "%m/%d/%Y %T");
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input opcclient>
    Module        im_file
    File          '%PRJ_PATH%\MASTER_OPC_*_OPC_KEP.LOG'
    <Exec>
        if $raw_event =~ %OPCTRC_REGEX%
        {
            $EventTime = strptime($1 + $2, "%Y%m%d%H%M%S");
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input dnp>
    Module        im_file
    File          '%DNP_PATH%\dnp_20210315_0018.log'
    <Exec>
        $raw_event = replace($raw_event, "\t", " ");
        if $raw_event =~ %DNP_REGEX%
        {
            $EventTime = strptime($1 + $2, "%m/%d/%Y %T");
            to_json();
        }
        else drop();
    </Exec>
</Input>

<Input dnp_soe>
    Module        im_file
    File          '%DNP_PATH%\dnp_soe**.log'
    <Exec>
        if $raw_event =~ %DNPSOE_REGEX%
        {
            $EventTime = strptime($1, "%Y %m %d %T");
            $SOE_TimeStamp = strptime($5, "%Y %m %d %T");
            to_json();
        }
        else drop();
    </Exec>
</Input>

# -------------------------- OUTPUT MODULE -------------------------------------

<Output to_file>
    Module        om_file
    File          'C:\output.txt'
</Output>

# ------------------------------ ROUTES ----------------------------------------

<Route r1>
    Path    recstat_csv, recstat_text, cor_status => to_file
</Route>

<Route r2>
    Path    protocol_stack_trace, web_conf, perfdata, opcclient => to_file
</Route>

<Route r3>
    Path    dnp, dnp_soe => to_file
</Route>

<Extension _json>
    Module        xm_json
</Extension>

<Input pcap_modbus>
    Module        im_pcap
    # Name of a network device/interface
    Dev           \Device\NPF_{E8451A5D-5676-4BEF-8ED5-68911C97D953}
    <Protocol>
        # Protocol type
        Type      modbus
    </Protocol>
    # Conversion to JSON
    Exec          to_json();
</Input>

{
  "modbus.function_code": "Read Holding Registers (03)",
  "modbus.length": "6",
  "modbus.prot_id": "0",
  "modbus.query.read_holding_regs.qty_of_regs": "3",
  "modbus.query.read_holding_regs.starting_address": "0",
  "modbus.trans_id": "844",
  "modbus.unit_id": "1",
  "EventTime": "2021-07-16T02:34:08.606328-07:00",
  "EventReceivedTime": "2021-07-16T02:34:09.241839-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

{
  "modbus.function_code": "Read Holding Registers (03)",
  "modbus.length": "9",
  "modbus.prot_id": "0",
  "modbus.response.read_holding_regs.byte_count": "6",
  "modbus.response.read_holding_regs.registers": "3260, 2937, 3152",
  "modbus.trans_id": "844",
  "modbus.unit_id": "1",
  "EventTime": "2021-07-16T02:34:08.623539-07:00",
  "EventReceivedTime": "2021-07-16T02:34:09.241839-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

<Extension _json>
    Module        xm_json
</Extension>

<Input pcap_bacnet>
    Module        im_pcap
    # Name of a network device/interface
    Dev           \Device\NPF_{E8451A5D-5676-4BEF-8ED5-68911C97D953}
    <Protocol>
        # Protocol type
        Type      bacnet
    </Protocol>
    Exec          to_json();
</Input>

{
  "bacnet.apdu.bacnet_confirmed_request.invoke_id": "159",
  "bacnet.apdu.bacnet_confirmed_request.max_resp": "1476",
  "bacnet.apdu.bacnet_confirmed_request.max_segs": "16",
  "bacnet.apdu.bacnet_confirmed_request.more_segments_follow": "false",
  "bacnet.apdu.bacnet_confirmed_request.segmented": "false",
  "bacnet.apdu.bacnet_confirmed_request.segmented_accepted": "true",
  "bacnet.apdu.bacnet_confirmed_request.service_choice": "Read Property (12)",
  "bacnet.apdu.bacnet_confirmed_request.service_request.records.0.object_identifier.instance_number": "0",
  "bacnet.apdu.bacnet_confirmed_request.service_request.records.0.object_identifier.type": "analog-input (0)",
  "bacnet.apdu.bacnet_confirmed_request.service_request.records.1.property_identifier": "present-value (85)",
  "bacnet.apdu.pdu_type": "BACnet-Confirmed-Request-PDU (0x00)",
  "bacnet.bvlc.function": "Original-Unicast-NPDU (0x0A)",
  "bacnet.bvlc.length": "27",
  "bacnet.bvlc.type": "BACnet/IP (Annex J) (0x81)",
  "bacnet.npdu.control": "0x0024",
  "bacnet.npdu.control.contains": "BACnet APDU message (0)",
  "bacnet.npdu.control.dst_spec": "DNET, DLEN, Hop Count present (1)",
  "bacnet.npdu.control.prio": "Normal message",
  "bacnet.npdu.control.reply_expected": "Yes (1)",
  "bacnet.npdu.control.src_spec": "SNET, SLEN, SADR absent (0)",
  "bacnet.npdu.version": "0x0001",
  "EventTime": "2021-08-02T13:39:36.318342-07:00",
  "EventReceivedTime": "2021-08-02T13:39:38.714328-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

{
  "bacnet.apdu.bacnet_complexack.more_segments_follow": "false",
  "bacnet.apdu.bacnet_complexack.original_invoke_id": "159",
  "bacnet.apdu.bacnet_complexack.segmented": "false",
  "bacnet.apdu.bacnet_complexack.service_ack.records.0.object_identifier.instance_number": "0",
  "bacnet.apdu.bacnet_complexack.service_ack.records.0.object_identifier.type": "analog-input (0)",
  "bacnet.apdu.bacnet_complexack.service_ack.records.1.property_identifier": "present-value (85)",
  "bacnet.apdu.bacnet_complexack.service_ack.records.2.records.0": "Opening Tag (3)",
  "bacnet.apdu.bacnet_complexack.service_ack.records.2.records.1": "963000.125000",
  "bacnet.apdu.bacnet_complexack.service_ack.records.2.records.2": "Closing Tag (3)",
  "bacnet.apdu.bacnet_complexack.service_choice": "Read Property (12)",
  "bacnet.apdu.pdu_type": "BACnet-Complex-ACK-PDU (0x03)",
  "bacnet.bvlc.function": "Original-Unicast-NPDU (0x0A)",
  "bacnet.bvlc.length": "32",
  "bacnet.bvlc.type": "BACnet/IP (Annex J) (0x81)",
  "bacnet.npdu.control": "0x0008",
  "bacnet.npdu.control.contains": "BACnet APDU message (0)",
  "bacnet.npdu.control.dst_spec": "DNET, DLEN, DADR, Hop Count absent (0)",
  "bacnet.npdu.control.prio": "Normal message",
  "bacnet.npdu.control.reply_expected": "No (0)",
  "bacnet.npdu.control.src_spec": "SNET, SLEN, SADR present (1)",
  "bacnet.npdu.version": "0x0001",
  "EventTime": "2021-08-02T13:39:36.647469-07:00",
  "EventReceivedTime": "2021-08-02T13:39:38.777825-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

<Extension _json>
    Module        xm_json
</Extension>

<Input pcap_dnp>
    Module        im_pcap
    # Name of a network device/interface
    Dev           \Device\NPF_{E8451A5D-5676-4BEF-8ED5-68911C97D953}
    <Protocol>
        # Protocol type
        Type      dnp3
    </Protocol>
    # Conversion to JSON
    Exec          to_json();
</Input>

{
  "dnp3.application_layer.control.con": "0",
  "dnp3.application_layer.control.fin": "1",
  "dnp3.application_layer.control.fir": "1",
  "dnp3.application_layer.control.sequence": "7",
  "dnp3.application_layer.control.uns": "0",
  "dnp3.application_layer.function_code": "Read",
  "dnp3.application_layer.object0.count": "0",
  "dnp3.application_layer.object0.group": "60",
  "dnp3.application_layer.object0.name": "Class objects - Class 0 data",
  "dnp3.application_layer.object0.variation": "1",
  "dnp3.application_layer.object1.count": "0",
  "dnp3.application_layer.object1.group": "60",
  "dnp3.application_layer.object1.name": "Class objects - Class 1 data",
  "dnp3.application_layer.object1.variation": "2",
  "dnp3.application_layer.object2.count": "0",
  "dnp3.application_layer.object2.group": "60",
  "dnp3.application_layer.object2.name": "Class objects - Class 2 data",
  "dnp3.application_layer.object2.variation": "3",
  "dnp3.application_layer.object3.count": "0",
  "dnp3.application_layer.object3.group": "60",
  "dnp3.application_layer.object3.name": "Class objects - Class 3 data",
  "dnp3.application_layer.object3.variation": "4",
  "dnp3.data_layer.control": "0xC4",
  "dnp3.data_layer.control.dir": "1",
  "dnp3.data_layer.control.fcb": "0",
  "dnp3.data_layer.control.fcv": "0",
  "dnp3.data_layer.control.function_code": "Unconfirmed User Data",
  "dnp3.data_layer.control.prm": "1",
  "dnp3.data_layer.destination": "1",
  "dnp3.data_layer.length": "20",
  "dnp3.data_layer.source": "2",
  "dnp3.data_layer.start_bytes": "0x0564",
  "dnp3.transport.fin": "1",
  "dnp3.transport.fir": "1",
  "dnp3.transport.sequence": "31",
  "EventTime": "2021-08-03T12:42:00.129992-07:00",
  "EventReceivedTime": "2021-08-03T12:42:00.860759-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

{
  "dnp3.application_layer.control.con": "0",
  "dnp3.application_layer.control.fin": "1",
  "dnp3.application_layer.control.fir": "1",
  "dnp3.application_layer.control.sequence": "7",
  "dnp3.application_layer.control.uns": "0",
  "dnp3.application_layer.function_code": "Response",
  "dnp3.application_layer.internal_indications.already_executing": "0",
  "dnp3.application_layer.internal_indications.broadcast": "0",
  "dnp3.application_layer.internal_indications.class1_events": "0",
  "dnp3.application_layer.internal_indications.class2_events": "0",
  "dnp3.application_layer.internal_indications.class3_events": "0",
  "dnp3.application_layer.internal_indications.config_corrupt": "0",
  "dnp3.application_layer.internal_indications.device_restart": "0",
  "dnp3.application_layer.internal_indications.device_trouble": "0",
  "dnp3.application_layer.internal_indications.events_buffer_overflow": "0",
  "dnp3.application_layer.internal_indications.local_control": "0",
  "dnp3.application_layer.internal_indications.need_time": "1",
  "dnp3.application_layer.internal_indications.no_func_code_support": "0",
  "dnp3.application_layer.internal_indications.object_unknown": "0",
  "dnp3.application_layer.internal_indications.parameter_error": "0",
  "dnp3.application_layer.internal_indications.reserved": "0 (expected 0)",
  "dnp3.application_layer.object0.count": "1",
  "dnp3.application_layer.object0.group": "30",
  "dnp3.application_layer.object0.name": "Analog input - single-precision, floating-point with flag",
  "dnp3.application_layer.object0.point0.flags": "[ONLINE]",
  "dnp3.application_layer.object0.point0.value": "2.540000",
  "dnp3.application_layer.object0.variation": "5",
  "dnp3.data_layer.control": "0x44",
  "dnp3.data_layer.control.dir": "0",
  "dnp3.data_layer.control.fcb": "0",
  "dnp3.data_layer.control.fcv": "0",
  "dnp3.data_layer.control.function_code": "Unconfirmed User Data",
  "dnp3.data_layer.control.prm": "1",
  "dnp3.data_layer.destination": "2",
  "dnp3.data_layer.length": "20",
  "dnp3.data_layer.source": "1",
  "dnp3.data_layer.start_bytes": "0x0564",
  "dnp3.transport.fin": "1",
  "dnp3.transport.fir": "1",
  "dnp3.transport.sequence": "40",
  "EventTime": "2021-08-03T12:42:00.133436-07:00",
  "EventReceivedTime": "2021-08-03T12:42:00.861419-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

<Extension _json>
    Module        xm_json
</Extension>

<Input pcap_iec>
    Module        im_pcap
    # Name of a network device/interface
    Dev           \Device\NPF_{E8451A5D-5676-4BEF-8ED5-68911C97D953}
    <Protocol>
        # Protocol types
        Type      iec104apci
    </Protocol>
    <Protocol>
        Type      iec104asdu
    </Protocol>
    # Converting to JSON
    Exec          to_json();
</Input>

{
  "iec104.apci.receive_sequence_number": "24589",
  "iec104.apci.send_sequence_number": "12552",
  "iec104.apci.type": "Information (I)",
  "iec104.asdu.data": {
    "io": [
      {
        "ioa": 1020
      }
    ],
    "ios": 1
  },
  "iec104.asdu.dui.cause_of_transmission": "Request or requested (5)",
  "iec104.asdu.dui.coa": "1",
  "iec104.asdu.dui.num_records": "1",
  "iec104.asdu.dui.org": "0",
  "iec104.asdu.dui.pn": "0",
  "iec104.asdu.dui.sq": "FALSE",
  "iec104.asdu.dui.test_bit": "0",
  "iec104.asdu.dui.type": "C_RD_NA_1",
  "EventTime": "2021-07-19T13:07:54.073324-07:00",
  "EventReceivedTime": "2021-07-19T13:07:54.886786-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}

{
  "iec104.apci.receive_sequence_number": "12553",
  "iec104.apci.send_sequence_number": "24589",
  "iec104.apci.type": "Information (I)",
  "iec104.asdu.data": {
    "io": [
      {
        "ioa": 1020,
        "ie": [
          {
            "type": "R32",
            "value": 10243
          },
          {
            "type": "QDS",
            "invalid": false,
            "not-topical": false,
            "substituted": false,
            "blocked": false,
            "overflow": false
          },
          {
            "type": "CP56Time2A",
            "milliseconds": 54006,
            "minutes": 7,
            "hours": 13,
            "day-of-week": 0,
            "day-of-month": 19,
            "month": 7,
            "year": 21
          }
        ],
        "ies": 3
      }
    ],
    "ios": 1
  },
  "iec104.asdu.dui.cause_of_transmission": "Request or requested (5)",
  "iec104.asdu.dui.coa": "1",
  "iec104.asdu.dui.num_records": "1",
  "iec104.asdu.dui.org": "0",
  "iec104.asdu.dui.pn": "0",
  "iec104.asdu.dui.sq": "FALSE",
  "iec104.asdu.dui.test_bit": "0",
  "iec104.asdu.dui.type": "M_ME_TF_1",
  "EventTime": "2021-07-19T13:07:54.078755-07:00",
  "EventReceivedTime": "2021-07-19T13:07:54.887761-07:00",
  "SourceModuleName": "pcap",
  "SourceModuleType": "im_pcap"
}