props.conf

[host::prodgate*]
KV_MODE = none
REPORT-barracudainfo = barracuda-syslog


transforms.conf


[barracuda-syslog]
REGEX = \]:\s+([^\s]+) ([^\s]+) (\d+) (\d+) (RECV|SCAN|SEND) (.*)
FORMAT = ip::$1 msg_id::$2 start_time::$3 end_time::$4 service::$5 info::$6