k.rennerandClaude Opus 4.7
3bc73abfa1
Add loki.process.udm_cef pipeline downstream of the udp-5514 raw listener. Single regex extracts the CEF:0 header (vendor / product / product_version / signature_id / event_name / cef_severity) plus the UNIFI* extension fields (UNIFIhost / -deviceName / -Model / -Ip / -Mac / -Version) and msg. Curated label promotion: vendor, product, signature_id, event_name, device_model, host (= device name). High- cardinality fields (device_ip, device_mac, msg, full version) stay in the extracted map and the line content remains the verbatim packet so unparsed sender variants still land queryably. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>