Refactor the structure of expressions in where blocks of filter cs_switch.

Author: JocLRojas

filters/cisco/cs_switch.yml

@@ -1,4 +1,4 @@
-# CISCO Switch filter, version 3.0.0
+# CISCO Switch filter, version 3.0.1
 # Based on https://www.cisco.com/c/en/us/support/ios-nx-os-software/index.html
 # and https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/17_xe/syslogs/17-15-x/b-system-message-guide-17-15-x.html
 # Support CISCO IOS from 15 SY to IOS XE v17
@@ -52,12 +52,7 @@ pipeline:
             - fieldName: log.ciscoMsg
               pattern: '{{.greedy}}'
           source: log.msg
-          where:
-            variables:
-              - get: log.msg
-                as: msg
-                ofType: string
-            expression: '(msg.contains("-MSG:SLOT") == false) && (msg.contains("-MSG: SLOT") == false)'
+          where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
       # Extracting subfacility if present
       - grok:
           patterns:
@@ -66,12 +61,7 @@ pipeline:
             - fieldName: log.severity
               pattern: '{{.integer}}'
           source: log.severity
-          where:
-            variables:
-              - get: log.msg
-                as: msg
-                ofType: string
-            expression: '(msg.contains("-MSG:SLOT") == false) && (msg.contains("-MSG: SLOT") == false)'
+          where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
       # --------------------------
       # Variant -> %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text
       - grok:
@@ -89,24 +79,14 @@ pipeline:
             - fieldName: log.ciscoMsg
               pattern: '{{.greedy}}'
           source: log.msg
-          where:
-            variables:
-              - get: log.msg
-                as: msg
-                ofType: string
-            expression: 'msg.contains("-MSG:SLOT") || msg.contains("-MSG: SLOT")'
+          where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
 
       - trim:
           function: prefix
           substring: '%'
           fields:
             - log.tmpFacilityMnemonic
-          where:
-            variables:
-              - get: log.msg
-                as: msg
-                ofType: string
-            expression: 'msg.contains("-MSG:SLOT") || msg.contains("-MSG: SLOT")'
+          where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
       # %FACILITY-SEVERITY-MNEMONIC
       - grok:
           patterns:
@@ -117,12 +97,7 @@ pipeline:
             - fieldName: log.facilityMnemonic
               pattern: '{{.data}}\:'
           source: log.tmpFacilityMnemonic
-          where:
-            variables:
-              - get: log.msg
-                as: msg
-                ofType: string
-            expression: 'msg.contains("-MSG:SLOT") || msg.contains("-MSG: SLOT")'
+          where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
       # Extracting subfacility if present
       - grok:
           patterns:
@@ -131,12 +106,7 @@ pipeline:
             - fieldName: log.severity
               pattern: '{{.integer}}'
           source: log.severity
-          where:
-            variables:
-              - get: log.msg
-                as: msg
-                ofType: string
-            expression: 'msg.contains("-MSG:SLOT") || msg.contains("-MSG: SLOT")'
+          where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
 
       # Cleaning common fields
       - trim:
@@ -169,34 +139,19 @@ pipeline:
           params:
             key: severity
             value: 'high'
-          where:
-            variables:
-              - get: log.severity
-                as: sev
-                ofType: string
-            expression: sev=="0" || sev=="1" || sev=="2" || sev=="3"
+          where: log.severity=="0" || log.severity=="1" || log.severity=="2" || log.severity=="3"
       - add:
           function: 'string'
           params:
             key: severity
             value: 'medium'
-          where:
-            variables:
-              - get: log.severity
-                as: sev
-                ofType: string
-            expression: sev=="4"
+          where: log.severity=="4"
       - add:
           function: 'string'
           params:
             key: severity
             value: 'low'
-          where:
-            variables:
-              - get: log.severity
-                as: sev
-                ofType: string
-            expression: sev=="5" || sev=="6" || sev=="7"
+          where: log.severity=="5" || log.severity=="6" || log.severity=="7"
       #......................................................................#
       # Removing unused fields
       - delete: