cscli parsers install Jgigantino31/ntfy-logsParser for Ntfy Logs.
1---2filenames:3 - /var/log/ntfy.log4labels:5 type: ntfy
1---2source: docker3container_name:4 - ntfy5#container_id:6# - 843ee92d231b7labels:8 type: ntfy
Note: If you want to use a log file, set the log-file option to the file you want to log to and adjust the filename above to match. If you want to use Docker logs, the log-file option must not be set. You must set the log-level to debug (or trace but trace has more information than is needed) and the log-format to json in order for the parser to be able to detect brute force attempts:
1log-level: debug2log-format: json
For where to set these options when configuring Ntfy, see Configuring the ntfy server.
1onsuccess: next_stage2name: Jgigantino31/ntfy-logs3description: "Parse ntfy logs"4filter: "evt.Parsed.program == 'ntfy'"5nodes:6 - filter: "JsonExtract(evt.Parsed.message, 'error_code') in ['40101', '40301']"7 statics:8 - meta: log_type9 value: ntfy_failed_auth1011statics:12 - meta: service13 value: ntfy14 - meta: source_ip15 expression: JsonExtract(evt.Parsed.message, "visitor_ip")16 - target: evt.StrTime17 expression: JsonExtract(evt.Parsed.message, "time")18