Module im_tcp Host 0.0.0.0 Port 1514 parse_syslog(); if $Message =~ /^%(ASA)-(\d)-(\d{6}): (.*)$/ { $ASASeverityNumber = $2; $ASAMessageID = $3; $ASAMessage = $4; }