[ossec-list] Decoding CEF log formats

[carlopmart]

Hi all,

 I am trying to write a new decoder to process CEF log formats, but I 
have a problems to escape '|'. For example:

<regex offset="after_prematch">^\d\|\d+\|</regex>

 doesn't works ... How can I escape '|' special character??

Thanks.
--
CL Martinez
carlopmart {at} gmail {d0t} com