{ "$schema": "https://lnav.org/schemas/format-v1.schema.json", "esx_syslog_log": { "title": "ESXi Syslog", "description": "Format specific to the ESXi syslog", "regex": { "std": { "pattern": "^(?(?:\\S{3,8}\\s+\\d{1,2} \\d{2}:\\d{2}:\\d{2}|\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z))\\s+(?\\w+)\$(?\\d+)\$(?:\\[\\+\\]|\\+)?(?:(?: (?(?(?:[^\\[:]+|[^:]+))(?:\\[(?\\d+)\\])?):\\s*(?.*))$|:?(?:(?: ---)? last message repeated \\d+ times?(?: ---)?))" }, "host": { "pattern": "^(?(?:\\S{3,8}\\s+\\d{1,2} \\d{2}:\\d{2}:\\d{2}|\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z))\\s+(?\\w+)\$(?\\d+)\$(?:\\[\\+\\]|\\+)?(?:(?: (?(?:host-(?\\d+))?)\\s+(?.*))$|:?(?:(?: ---)? last message repeated \\d+ times?(?: ---)?))" }, "notime": { "pattern": "^(?\\d{4}-\\d{2}-\\d{2})\\s+(?\\w+)\$(?\\d+)\$\\s+(?[^\\[]+)\\[(?\\d+)\\]:\\s(?\\d{2}:\\d{2}:\\d{2}\\.\\d+)\\s+(?.*)" } }, "level": { "debug": "^Db$", "info": "^In$", "notice": "^No$", "warning": "^Wa$", "error": "^Er$", "critical": "^Cr$", "fatal": "^(?:Al|Em)$" }, "opid-field": "log_syslog_tag", "time-field": "new_time", "multiline": false, "value": { "body": { "kind": "string" }, "log_pid": { "kind": "string", "identifier": true }, "log_procname": { "kind": "string", "identifier": true }, "log_syslog_tag": { "kind": "string" }, "syslog_pri": { "kind": "string" }, "timestamp": { "kind": "string" } }, "sample": [ { "line": "2022-06-02T05:34:56.746Z In(14) ConfigStore[1001430703]: Log for ConfigStore version=1.0 build=build-19833347 option=BETA" }, { "line": "2022-06-02T05:34:23Z In(14)[+] hostprofile[1001430319]: {'mode': 'Disabled', 'exceptionUsers': []}" }, { "line": "2022-06-02 In(14) hostprofile[1001430319]: 05:34:23.666 {'mode': 'Disabled', 'exceptionUsers': []}" }, { "line": "2022-06-01T13:42:40.681Z In(05) host-16250 Skip service health check. State STOPPED, Curr request 0" } ] } }