[ossec-list] Re: Decoding CEF log formats

[carlopmart]

On 05/04/2012 10:01 PM, carlopmart wrote:

Hi all,

I am trying to write a new decoder to process CEF log formats, but I
have a problems to escape '|'. For example:

<regex offset="after_prematch">^\d\|\d+\|</regex>

doesn't works ... How can I escape '|' special character??

Thanks.

Please, any idea??

--
CL Martinez
carlopmart {at} gmail {d0t} com