A collection to defend Jellyfin instance against common attacks :

• Jellyfin parser
• Jellyfin bruteforce detection

Example acquisition for this collection :

If using LOG_FILE environment variable:

1---
2filenames:
3 - /var/log/jellyfin/log_*.log
4labels:
5  type: jellyfin

For Docker directly

1---
2source: docker
3container_name:
4 - jellyfin
5#container_id:
6# - 843ee92d231b
7labels:
8  type: jellyfin

Note: If you are using Docker logs (directly or sending them to a syslog server), the output format is incorrect and will not match.
Create a copy of logging.default.json to logging.json in Jellyfin config directory (it will override the logging.default.json) and change the console output template like the following :

1...
2        "WriteTo": [
3            {
4                "Name": "Console",
5                "Args": {
6                    "outputTemplate": "[{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz}] [{Level:u3}] [{ThreadId}] {SourceContext}: {Message:lj}{NewLine}{Exception}"
7                }
8            },
9...