cscli parsers install Jgigantino31/calibre-web-logsParser for Calibre-Web Logs.
1---2filenames:3 - /var/log/calibre-web/calibre-web.log4labels:5 type: calibre-web
1onsuccess: next_stage2#debug: false3name: Jgigantino31/calibre-web-logs4description: "Parse calibre-web logs"5filter: "evt.Parsed.program == 'calibre-web'"6pattern_syntax:7 CALIBREWEB_CUSTOMDATE: "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"8nodes:9 - grok:10 pattern: '(\[%{CALIBREWEB_CUSTOMDATE:timestamp}.*\])?.*Login failed for user "%{HTTPDUSER:username}" IP-address: %{IP:source_ip}'11 apply_on: message12 statics:13 - meta: log_type14 value: calibre-web_failed_auth1516statics:17 - meta: service18 value: calibre-web19 - meta: user20 expression: "evt.Parsed.username"21 - meta: source_ip22 expression: "evt.Parsed.source_ip"23 - target: evt.StrTime24 expression: evt.Parsed.timestamp25