{
  "title": "accelppp_unclassified_error",
  "description": "accel-ppp: fallback for any 'error:' line that no specific rule already classified - same catch-all philosophy as generic_critical_severity, but text-based (Vector-shipped accel-ppp lines have no real syslog PRI header, so the numeric severity field is always -1/unparseable and generic_critical_severity never fires for this source).",
  "source": "rule \"accelppp_unclassified_error\"\nwhen\n  !has_field(\"event_type\") && contains(to_string($message.message), \"error:\")\nthen\n  set_field(\"vendor\", \"accel-ppp\");\n  set_field(\"event_type\", \"accelppp_unclassified_error\");\n  set_field(\"severity_tag\", \"critical\");\nend"
}