{
  "title": "a10_bgp_maxpfx_warning",
  "description": "A10 Router process: BGP peer approaching its configured max-prefix limit (IPv4 Unicast) - early warning before the session would be reset for exceeding it. Built from real captured A10 syslog output.",
  "source": "rule \"a10_bgp_maxpfx_warning\"\nwhen\n  contains(to_string($message.message), \"BGP-4-MAXPFX\")\nthen\n  set_field(\"vendor\", \"a10\");\n  set_field(\"event_type\", \"bgp_maxpfx_warning\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"from (\\\\S+) \\\\(IPv4 Unicast\\\\): reaches (\\\\d+), max (\\\\d+)\", to_string($message.message), [\"peer\",\"count\",\"max\"]);\n  set_field(\"bgp_peer\", m[\"peer\"]);\n  set_field(\"bgp_prefix_count\", to_long(m[\"count\"]));\n  set_field(\"bgp_prefix_max\", to_long(m[\"max\"]));\nend"
}