#Hirschmann
[force_sourcetype_for_hirschmann_rs30]
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::hirschmann:rs30
REGEX = (?<device_time>\w+\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}) (?<reported_hostname>\S+)(-[0-9]+)? (?<process>[^\[]+)\[(?<pid>\d+)\]: (?<code_file>\S+\.c)\((?<line>\d+)\) (?<event_id>\d+) %% (?<message_text>.+)