Ah, since I started on this the upstream project has changed slightly to move the syslog producer to a separate repo so the changes I've made so far aren't compatible. I'll review and change these.

Essentially I added:

filter f_a10_thunder_cef_msg {
    match('CEF:', value("MSGHDR")) and match('|A10|' value("MESSAGE"));
};

log {
    source(s_net);
    filter(f_a10_thunder_cef_msg);
    destination(d_kafka_a10_thunder);
};

to the producer/syslog/cgn-ec.conf.d/a10-thunder.conf file, and also added:

            set("${MSGHDR}"    value(".eventv1.msghdr")       condition("${.eventv1.msghdr}" eq ""));

to rewrite block.

(syslog-ng treats the CEF: part of the message as the message header (normally programname[pid] so the rest of the message otherwise gets handled as just 0|A10|CFW|...)

Hey @ShaneMcC

I've released v0.8.0 of the consumer to handle the CEF parsing (with the partition/vrf support)

It will however require the api v0.5.0 (which fixes the return types for the vrf from int to str), and also a manual alter of the timescaledb tables vrf_id to VARCHAR

Let me know when you get the chance to test this out, I've ran it against a virtual A10 vm with LSN configured in eve-ng and everything appears to be working as expected for my 1 client