Skip to content

Commit 62b8541

Browse files
committed
Update props.conf
Updated log type extraction based on feedback from customer. Some GHES environments include hostname instead of IP address in the log events. Hostname failed the regex match.
1 parent eb35c92 commit 62b8541

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

github_app_for_splunk/default/props.conf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[default]
2-
[GithubEnterpriseServerAuditLog]
2+
[GithubEnterpriseServerLog]
33
DATETIME_CONFIG =
44
LINE_BREAKER = ([\r\n]+)
55
NO_BINARY_CHECK = true
@@ -9,7 +9,7 @@ TIME_FORMAT =
99
TZ =
1010
EXTRACT-audit_event = github_audit\[\d+\]\:\s(?<audit_event>.*)
1111
EXTRACT-audit_fields = \"(?<_KEY_1>.*?)\"\:\"*(?<_VAL_1>.*?)\"*,
12-
EXTRACT-github_log_type = \d+\:\d+\:\d+\s\d+\-\d+\-\d+\-\d+\s(?<github_log_type>.*?)\:
12+
EXTRACT-github_log_type = \d+\:\d+\:\d+\s[\d\w\-]+\s(?<github_log_type>.*?)\:
1313
EXTRACT-github_document_id = \"_document_id\"\:\"(?<document_id>.*?)\"
1414
FIELDALIAS-source = github_log_type AS source
1515

0 commit comments

Comments
 (0)