<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Custom Log Collectors — API Reference

## Syslog Formats

```
# RFC 3164 (BSD)
<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8

# RFC 5424
<165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3"] msg
```

## Splunk HEC API

```bash
# Send event
curl -k https://splunk:8088/services/collector -H "Authorization: Splunk <token>" \
  -d '{"event":"test event","sourcetype":"custom:security"}'

# Send raw data
curl -k https://splunk:8088/services/collector/raw -H "Authorization: Splunk <token>" \
  -d 'raw log line here'

# Health check
curl -k https://splunk:8088/services/collector/health
```

## Elasticsearch Bulk API

```bash
# Bulk index
curl -X POST http://elastic:9200/_bulk -H "Content-Type: application/json" -d '
{"index":{"_index":"security-logs"}}
{"timestamp":"2024-01-01T00:00:00Z","host":"server1","message":"failed login"}
'
```

## CEF Format

```
CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
CEF:0|Custom|LogCollector|1.0|AUTH_FAIL|Failed Authentication|7|src=10.0.0.1 dst=10.0.0.2 msg=Failed login
```

## Python watchdog (File Monitoring)

```python
from watchdog.observers import Observer
from watchdog.events import FileModifiedEvent, FileSystemEventHandler

class LogHandler(FileSystemEventHandler):
    def on_modified(self, event):
        if isinstance(event, FileModifiedEvent):
            # Process new lines
            pass

observer = Observer()
observer.schedule(LogHandler(), path="/var/log", recursive=False)
observer.start()
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Collection completed successfully |
| 1 | Parse errors encountered (partial success) |
| 2 | Fatal error (file not found, connection refused) |
