Cisco logs match syslog rules

[Lopuiz]

Hi team,

This cisco's log should match rule 4715.

Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID`

**Phase 1: Completed pre-decoding.
       full event: 'Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID'
       timestamp: '(null)'
       hostname: 'lopezziur-S551LN'
       program_name: '(null)'
       log: 'Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID'

**Phase 2: Completed decoding.
       decoder: 'cisco-ios'
       id: '%DOT1X-5-FAIL'

**Phase 3: Completed filtering (rules).
       Rule id: '4715'
       Level: '6'
       Description: 'Cisco IOS notification message.'
**Alert to be generated.

This event is comunicated from agent by syslog. And its full log is 2019 May 06 09:28:12 vm-ubuntu16->10.0.0.16 May 6 07:28:11 vm-ubuntu16 fortinet Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID (from archives.log).
This log match rule 2501 not 4715.

2019 May 06 09:28:12 vm-ubuntu16->10.0.0.16 May  6 07:28:11 vm-ubuntu16 fortinet Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID


**Phase 1: Completed pre-decoding.
       full event: '2019 May 06 09:28:12 vm-ubuntu16->10.0.0.16 May  6 07:28:11 vm-ubuntu16 fortinet Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID'
       timestamp: '2019 May 06 09:28:12'
       hostname: 'lopezziur-S551LN'
       program_name: '(null)'
       log: 'vm-ubuntu16->10.0.0.16 May  6 07:28:11 vm-ubuntu16 fortinet Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID'

**Phase 2: Completed decoding.
       No decoder matched.

**Phase 3: Completed filtering (rules).
       Rule id: '2501'
       Level: '5'
       Description: 'syslog: User authentication failure.'
**Alert to be generated.

[Lopuiz]

We have to create new decoders that match full log