[Wasabules]

Stacked on #100, itself on #99. It will be retargeted to main once they are merged.

Templates

Start from, at the top of the rule editor, fills in the format and the corrections from a template. The rule keeps its name, its on/off state and its addresses.

Seven templates come with SyslogStudio (sources.Templates). Each one sets what the reading as received cannot guess:

Template	What it sets
Sends no hostname	It sends none (see below)
Camera or IoT device	It sends none, and the severity from the message text
Level in the text	The severity from the message text
JSON behind a syslog header	The JSON format (Docker, Kubernetes…)
Garbled accents (Windows-1252)	The Windows-1252 encoding
Clock not to be trusted	The arrival time
A format of its own	A regular expression with named groups, to adapt

templates_test.go checks the templates:

• each one is read on a message from the kind of device it is for;
• a template is refused if, on that message, it gives the same result as the reading as received. This is why there is no FortiGate template: its key=value is already read;
• each template has a name and a hint in all 8 locale files.

Your own templates

Save as a template… keeps a way of reading under a name of your own: the format (a regular expression included) and the corrections, never the devices.

• You can save one from the rule editor, or from a file import's Format.
• Your templates are offered in both places: Start from in the editor, From one of your templates in the import.
• They are listed under Settings › Sources › Your templates, where they can be deleted.
• They are stored in the window's own settings (sourceTemplates), so they stay the person's whichever engine the window drives. They are App methods, not Backend ones.

Sharing rules

• Export… writes the rules and your templates to a JSON file (syslogstudio-source-rules, version 1, without ids).
• Import… reads such a file:
  • The whole file is refused if any rule or template in it would not be saved, or if it comes from a newer version. A broken rule is named in the error.
  • Its templates are added to yours.
  • Its rules are saved through the Backend, so they reach the engine the window drives. They are added after the existing rules and turned off, because the addresses they name belong to another network until someone has checked them.

"It sends none"

New correction SourceRule.NoHostname, offered in the Hostname menu:

• An RFC 3164 message from a device that sends no hostname has the word after its timestamp read as a hostname. <14>Oct 27 09:14:02 motion detected is read as host motion.
• With this correction, that word goes back into the tag or the text (syslog.RereadWithoutHost), and the hostname is the source address.
• RFC 5424 messages, and headers that are not the RFCs' (read by WireReader), are left as they are.

Also

• The import and rule dialogs no longer squeeze their content to fit, as Settings already doesn't since feat(sources): read stored messages again with the rules #100. In the import, the file's name and its sample were being cut.
• The import-format screenshots are regenerated.
• The 8 languages, the user guide (Templates, and sharing rules), the README and the documentation page are updated.

Tests

• internal/sources:
  • templates on real-shaped messages, and their names in every locale;
  • a file's round trip;
  • refused files: not JSON, another format, a newer version, nothing in it, one broken rule (named), an unnamed template.
• internal/syslog: RereadWithoutHost (words restored, timestamp kept; RFC 5424 and Cisco left alone).
• main: your own templates are saved without addresses, offered after the built-in ones, replaced by ID and deleted; an unnamed template or one with an invalid pattern is refused.
• UI checked through the screenshot bridge: the editor with a template applied, the Sources tab, the import's format panel.

Checked: go vet (Windows, Linux), staticcheck, go test -race ./..., svelte-check --fail-on-warnings, npm test, npm run build, the docs' links.