{
  "title": "dlink_interface_link_state",
  "description": "D-Link: port link up/down - d'link.csv row 4. Shares the 'interface_link_state' event_type with bdcom_epon_interface_link_state for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_interface_link_state\"\nwhen\n  contains(to_string($message.message), \"Port\") && (contains(to_string($message.message), \"link down\") || contains(to_string($message.message), \"link up\"))\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"interface_link_state\");\n  let m = regex(\"Port (\\\\S+) link (up|down)\", to_string($message.message), [\"port\",\"state\"]);\n  set_field(\"link_interface\", m[\"port\"]);\n  set_field(\"link_state\", m[\"state\"]);\nend"
}