Add alias for netfilter logs

aliases/netfilter.toml

@@ -0,0 +1,4 @@
+keyword = "netfilter"
+template = """
+parse "* * kernel: [*] * IN=* OUT=* SRC=* DST=* LEN=* TOS=* PREC=* TTL=* ID=* PROTO=* SPT=* DPT=* WINDOW=* RES=* * URGP=*" as timestamp, hostname, x, tag, ifIn, ifOut, src, dst, len, tos, prec, ttl, id, protocol, sport, dport, window, res, flags, urgp
+"""

tests/structured_tests/aliases/netfilter.toml

@@ -0,0 +1,10 @@
+query = """* | netfilter"""
+input = """
+2023-05-02T11:12:50.823305+00:00 fw.example.com kernel: [576812.045483] Firewall: DROPPED IN=bond1 OUT=bond1 MAC=9e:ee:03:11:12:05:00:1f:6d:b5:18:00:08:00 SRC=192.0.2.100 DST=192.0.2.200 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=46326 PROTO=TCP SPT=123 DPT=456 WINDOW=1024 RES=0x00 SYN URGP=0
+2023-05-02T11:00:01.786039+00:00 fw1.example.com kernel: [578791.811376] Firewall IN=ens5 OUT=ens6 MAC=2a:e8:c0:3e:4b:17:ae:f6:8c:55:e9:a3:08:00 SRC=192.0.2.111 DST=192.0.2.222 LEN=226 TOS=0x00 PREC=0xC0 TTL=63 ID=24087 PROTO=ICMP TYPE=3 CODE=3 [SRC=10.10.10.10 DST=10.20.30.40 LEN=198 TOS=0x00 PREC=0x80 TTL=122 ID=3067 PROTO=UDP SPT=53 DPT=36506 LEN=178 ]
+2023-05-02T11:00:02.136051+00:00 fwall kernel: [2839042.118073] [FIREWALL][OUTPUT] IN= OUT=ens5 SRC=192.0.2.11 DST=192.0.2.22 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=11993 DF PROTO=TCP SPT=60488 DPT=443 WINDOW=62727 RES=0x00 SYN URGP=0
+2023-05-02T11:00:07.372179+00:00 foo.example.net kernel: [2765257.090978] [FIREWALL][OUTPUT] IN= OUT=ens3 SRC=192.0.2.123 DST=192.0.2.321 LEN=339 TOS=0x00 PREC=0xC0 TTL=64 ID=21371 DF PROTO=UDP SPT=68 DPT=67 LEN=319
+"""
+output = """
+[addr=127.0.0.1]        [bytes_sent=615]               [gzip_ratio=-]                 [http_referer=-]                   [http_user_agent=curl/7.77.0]            [method=GET]           [protocol=HTTP/1.1]        [status=200]           [timestamp=23/Feb/2023:17:05:13 +0000]        [url=/]          [user=-]
+"""