You will need to modify the parser manually. You can use or statements in parsers tho, so that will help. Going to try and write it out for what you will likely need to do with not knowing what your xml looks like.
Log
[software internal system syslog] CLI command [user admin, mode [local]VALGP]: directory /hd-raid/
Parser
[<fld1>] <event_description> [user <event_user>, mode [local]<hostname>]: <results>
Log
[software internal system syslog] CLI command [user admin, mode [local]VALGP(config)]: config
Parser
[<fld1>] <event_description> [user <event_user>, mode [local]<hostname>(<action>)]: <results>
As you can see with the top one it will add anything in the ]] section to hostname, but the second will do anything until the ( then it will do action for the rest. It is very static on how the parsers work for that version. But we can combine them like this
[<fld1>] <event_description> [user <event_user>, mode {[local]<hostname>]: | [local]<hostname>(<action>)]:} <results>
A | will act as an or statement for the parser so it is going to look at either the first style or the second style and parser correctly. If you want to post your xml or let me know how it works. I of course do not know the actual meta you want to populate but that was just for an example.
