1onsuccess: next_stage
2#debug: false
3name: Jgigantino31/calibre-web-logs
4description: "Parse calibre-web logs"
5filter: "evt.Parsed.program == 'calibre-web'"
6pattern_syntax:
7  CALIBREWEB_CUSTOMDATE: "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"
8nodes:
9  - grok:
10      pattern: '(\[%{CALIBREWEB_CUSTOMDATE:timestamp}.*\])?.*Login failed for user "%{HTTPDUSER:username}" IP-address: %{IP:source_ip}'
11      apply_on: message
12      statics:
13        - meta: log_type
14          value: calibre-web_failed_auth
15
16statics:
17    - meta: service
18      value: calibre-web
19    - meta: user
20      expression: "evt.Parsed.username"
21    - meta: source_ip
22      expression: "evt.Parsed.source_ip"
23    - target: evt.StrTime
24      expression: evt.Parsed.timestamp
25