#sbc
[force_sourcetype_for_sbc]
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::sbc
REGEX = (?<device_time>\w+\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}) (?<reported_hostname>\S+)(-[0-9]+)? .* (?<sequence>\[S=\d*]) (?<ID>\[[S,B]ID=.*]) \s*(?<message_text>.*)