bro_sip_graylog_pipeline.txt

rule "Extract bro_sip log fields"
when
  has_field("application_name") &&
  contains(value: to_string($message.application_name), search: "bro_sip", ignore_case: true)
then
  let m = split("\\|", to_string($message.message));

  set_field("ts", m[0]);
  set_field("uid", m[1]);
  set_field("id_orig_h", m[2]);
  set_field("id_orig_p", to_long(m[3]));
  set_field("id_resp_h", m[4]);
  set_field("id_resp_p", to_long(m[5]));
  set_field("username", m[6]);
  set_field("mac", m[7]);
  set_field("remote_ip", m[8]);
  set_field("connect_info", m[9]);
  set_field("result", m[10]);
end