{
  "title": "olt_config_write",
  "description": "BDCOM/OLT-style: config file written",
  "source": "rule \"olt_config_write\"\nwhen\n  contains(to_string($message.message), \"is wrote, TID:\")\nthen\n  set_field(\"vendor\", \"bdcom_olt\");\n  set_field(\"event_type\", \"config_write\");\n  let m = regex(\"/(\\\\S+) is wrote, TID:(\\\\S+)\", to_string($message.message), [\"config_file\",\"tid\"]);\n  set_field(\"config_file\", m[\"config_file\"]);\n  set_field(\"config_tid\", m[\"tid\"]);\nend"
}