1onsuccess: next_stage
2#debug: false
3name: LePresidente/gitea-logs
4filter: "evt.Parsed.program == 'gitea'"
5description: "Parse gitea logs"
6pattern_syntax:
7  GITEA_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"
8  GITEA_CUSTOMDATE: "%{DATE_X} %{TIME}"
9nodes:
10  - grok:
11      pattern: '^%{GITEA_CUSTOMDATE:timestamp}.*?Failed authentication attempt for %{GITEA_CUSTOMUSER:username} from %{IP:remote_ip}:%{NUMBER:remote_port}.* user does not exist'
12      apply_on: message
13      statics:
14        - meta: log_type
15          value: gitea_failed_auth
16  - grok:
17      pattern: '^%{GITEA_CUSTOMDATE:timestamp}.*?Failed authentication attempt for %{GITEA_CUSTOMUSER:username} from \[%{IP:remote_ip}\].* user does not exist' 
18      apply_on: message
19      statics:
20        - meta: log_type
21          value: gitea_failed_auth
22  - grok:
23      pattern: '^%{GITEA_CUSTOMDATE:timestamp}.*?Failed authentication attempt from %{IP:remote_ip}:%{NUMBER:remote_port}'
24      apply_on: message
25      statics:
26        - meta: log_type
27          value: gitea_failed_auth
28  - grok:
29      pattern: '^%{GITEA_CUSTOMDATE:timestamp}.*?Failed authentication attempt from \[%{IP:remote_ip}\]'
30      apply_on: message
31      statics:
32        - meta: log_type
33          value: gitea_failed_auth
34  - grok:
35      pattern: "^%{GITEA_CUSTOMDATE:timestamp}.*?Failed authentication attempt for %{GITEA_CUSTOMUSER:username} from %{IP:remote_ip}:%{NUMBER:remote_port}.* user's password is invalid"
36      apply_on: message
37      statics:
38        - meta: log_type
39          value: gitea_failed_auth
40  - grok:
41      pattern: "^%{GITEA_CUSTOMDATE:timestamp}.*?Failed authentication attempt for %{GITEA_CUSTOMUSER:username} from %{IP:remote_ip}:%{NUMBER:remote_port}.* (user|Email address) does not exist"
42      apply_on: message
43      statics:
44        - meta: log_type
45          value: gitea_failed_auth
46
47statics:
48    - meta: service
49      value: gitea
50    - meta: user
51      expression: "evt.Parsed.username"
52    - target: evt.StrTime
53      expression: evt.Parsed.timestamp
54    - meta: source_ip
55      expression: "evt.Parsed.remote_ip"
56