Message structure
This block is used to obtain data processed by the program. There is a possibility to obtain data from a message dictionary – key data, meta, raw raw_real. There is a special value event for accessing the whole structure.
The difference between raw and raw_real is that raw is already stripped to only valid syslog data - offset is applied, but raw_real value is not stripped.
XML representation of the message block
<xml xmlns="http://www.w3.org/1999/xhtml">
<block type="message">
<field name="OBJECT">msg</field>
</block>
<block type="message">
<field name="OBJECT">meta</field>
</block>
<block type="message">
<field name="OBJECT">raw</field>
</block>
<block type="message">
<field name="OBJECT">event</field>
</block>
</xml>

Block “Message”

Example of “message” block
Message block is used twice in the example:
- If text message row: Reads data from the “raw” key and then compares, if it contains the word “admin”. If yes, it returns boolean value “true”.
- Update dictionary row: updates the dictionary “message” key “data” by dictionary “item”.
Login permitted from 192.168.10.1/1234 to inside:192.168.1.1/https for user admin

Results of the “message” block