Mechanism for optional fields

[sethhall]

It would be great if there was a mechanism to declare optional fields in rules. The two following rules give a great use case for this request. (and I looked this time and didn't see a similar request!) 😄

rule=openssh_failed_password:Failed password for invalid user %user:word% from %ip:ipv4% port %port:number% ssh%ssh-ver:number%%tail:rest%
rule=openssh_failed_password:Failed password for %user:word% from %ip:ipv4% port %port:number% ssh%ssh-ver:number%%tail:rest%

[davidelang]

This will be available in the v2 version (currently v2 experimetnal

two ways of doing it

you can specify an alternative for a particular field, or you can define a new type that can have one of several types/values

for example,
type=apachefield:-
type=apachefield:%name:op-quoted-string%
and then use the type @apachefield instead of word etc.