#Sourcetype pour sbc [sbc] SHOULD_LINEMERGE=false KV_MODE = none EXTRACT-sbc-generic = (?\w+\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}) (?\S+)(-[0-9]+)? .* (?\[S=\d*]) (?\[[S,B]ID=.*]) \s*(?.*) description = Sourcetype pour sbc equipements [syslog] TRANSFORMS-sourcetype-sbc = force_sourcetype_for_sbc