Firewall syslog to a SIEM, with PII masked

receivers:
  syslog:
    udp:
      listen_address: 0.0.0.0:5514
    protocol: rfc3164

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # Masks e-mail addresses and pseudonymises user names (in the message and
  # the raw body) before the events leave for the SIEM; source and destination IPs stay, they are
  # what the SIEM correlates on.
  transform/pii:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          # Hash first: once the next statement masks user=, there is nothing left to hash.
          - set(attributes["user.hash"], SHA256(Concat(["${env:USER_HASH_SALT}", ExtractPatterns(attributes["message"], "user=(?P<u>[^ ]+)")["u"]], ""))) where IsMatch(attributes["message"], "user=")
          - replace_pattern(attributes["message"], "[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2,}", "<email>")
          - replace_pattern(attributes["message"], "user=([^ ]+)", "user=<user>")
          # The syslog receiver keeps the raw line in the body too: mask it there as well.
          - replace_pattern(body, "[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2,}", "<email>")
          - replace_pattern(body, "user=([^ ]+)", "user=<user>")
  batch:
    timeout: 5s

exporters:
  splunk_hec:
    endpoint: https://siem.example.internal:8088/services/collector
    token: ${env:SPLUNK_HEC_TOKEN}
    index: firewall
    sourcetype: syslog
    sending_queue:
      enabled: true
      queue_size: 5000
    retry_on_failure:
      enabled: true
      initial_interval: 5s
      max_interval: 30s
      max_elapsed_time: 300s

service:
  pipelines:
    logs:
      receivers: [syslog]
      processors: [memory_limiter, transform/pii, batch]
      exporters: [splunk_hec]