{
  "title": "olt_cli_logout",
  "description": "BDCOM/OLT-style CLI: user logged out from vty",
  "source": "rule \"olt_cli_logout\"\nwhen\n  contains(to_string($message.message), \"logouted from\")\nthen\n  set_field(\"vendor\", \"bdcom_olt\");\n  set_field(\"event_type\", \"cli_logout\");\n  let m = regex(\"User (\\\\S+) logouted from (\\\\S+) on vty (\\\\d+)\", to_string($message.message), [\"user\",\"from_ip\",\"vty\"]);\n  set_field(\"cli_user\", m[\"user\"]);\n  set_field(\"cli_vty\", m[\"vty\"]);\nend"
}