@@ -5,10 +5,15 @@ name: syslog
55file_extensions:
66 - syslog
77scope: text.syslog
8+variables:
9+ ipv4_part: (?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
810contexts:
911 main:
10− - match: '^\w+\s+\d+\s+\d{2}:\d{2}:\d{2}'
12+ - match: ^(\w+\s+\d+)\s+(\d{2}:\d{2}:\d{2})
1113 scope: meta.datetime.syslog constant.numeric.syslog
14+ captures:
15+ 1: meta.date.syslog
16+ 2: meta.time.syslog
1217 push: loghost
1318 loghost:
1419 - match: '[\w-]+'
@@ -20,7 +25,8 @@ contexts:
2025 1: support.function.process.syslog
2126 2: punctuation.separator.pid.begin.syslog
2227 3: meta.pid.syslog meta.number.integer.syslog constant.numeric.value.syslog
23− 4: punctuation.separator.mapping.syslog
28+ 4: punctuation.separator.pid.end.syslog
29+ 5: punctuation.separator.mapping.syslog
2430 set: structured-data
2531 structured-data:
2632 - match: '\['
@@ -56,15 +62,50 @@ contexts:
5662 captures:
5763 1: punctuation.definition.string.begin.syslog
5864 3: punctuation.definition.string.end.syslog
59− - match: \d+
60− scope: meta.number.integer.syslog constant.numeric.value.syslog
65+ - include: numbers
6166 - match: \b(CMD)\b\s+(\()
6267 captures:
6368 1: entity.name.label.syslog
6469 2: punctuation.section.block.begin.syslog
6570 embed: scope:source.shell.bash
66− escape: \)
71+ escape: \)$
6772 escape_captures:
6873 0: punctuation.section.block.end.syslog
74+ - match: '<\w+>'
75+ scope: constant.language.syslog
76+ - match: (?i:fail(?:ure|ed)?|error)
77+ scope: invalid.illegal.error.syslog
6978 - match: $
7079 pop: true
80+ numbers:
81+ - match: (?=(?:{{ipv4_part}}\.){3}{{ipv4_part}})
82+ push:
83+ - meta_scope: meta.ipaddress.v4.syslog meta.number.integer.decimal.syslog
84+ - match: \d+
85+ scope: constant.numeric.value.syslog
86+ - match: \.
87+ scope: punctuation.separator.sequence.syslog
88+ - match: ''
89+ pop: true
90+ - match: (?=(?:\h{0,4}:){2,6}\h{1,4})
91+ push:
92+ - meta_scope: meta.ipaddress.v6.syslog meta.number.integer.hexadecimal.syslog
93+ - match: \h{1,4}
94+ scope: constant.numeric.value.syslog
95+ - match: ':'
96+ scope: punctuation.separator.sequence.syslog
97+ - match: ''
98+ pop: true
99+ - match: (0x)(\h+)(?:(\.)(\h+))?
100+ scope: meta.number.float.hexadecimal.syslog
101+ captures:
102+ 1: constant.numeric.base.syslog
103+ 2: constant.numeric.value.syslog
104+ 3: constant.numeric.value.syslog punctuation.separator.decimal.syslog
105+ 4: constant.numeric.value.syslog
106+ - match: \b\d+(\.)\d+\b
107+ scope: meta.number.float.syslog constant.numeric.value.syslog
108+ captures:
109+ 1: punctuation.separator.decimal.syslog
110+ - match: \b\d+\b
111+ scope: meta.number.integer.syslog constant.numeric.value.syslog