^[a-z0-9-]+(?:,[a-z0-9-]+)*,(?:debug|info|warning|error|critical)(?:,[a-z0-9-]+)* mikrotik-mikr ^(\S+) (.*)$ mikrotik.topics, mikrotik.message mikrotik-mikr user (\S+) logged (in|out)(?: from (\S+))? via (\S+)$ dstuser, mikrotik.login, srcip, mikrotik.via mikrotik-mikr login failure for user (.+?) from (\S+) via (\S+)$ dstuser, srcip, mikrotik.via mikrotik-mikr (.+?) (changed|added|removed|moved|enabled|disabled) by ([^\s:]+):([^\s@]+)@(\S+)(?: \((.*)\))?$ mikrotik.object, mikrotik.change, mikrotik.via, dstuser, srcip, mikrotik.command mikrotik-mikr (\S+) link (up|down)\b mikrotik.interface, mikrotik.link