cscli parsers install LePresidente/jellyfin-logsParser for Jellyfin Logs.
---
filenames:
- /var/log/jellyfin/log_*.log
labels:
type: jellyfinNote: If you are using Docker logs (directly or sending them to a syslog server), the output format is incorrect and will not match.
Create a copy of logging.default.json to logging.json in Jellyfin config directory (it will override the logging.default.json) and change the console output template like the following :
...
"WriteTo": [
{
"Name": "Console",
"Args": {
"outputTemplate": "[{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz}] [{Level:u3}] [{ThreadId}] {SourceContext}: {Message:lj}{NewLine}{Exception}"
}
},
...1onsuccess: next_stage2#debug: false3name: LePresidente/jellyfin-logs4description: "Parse jellyfin logs"5filter: "evt.Parsed.program == 'jellyfin'"6pattern_syntax:7 JELLYFIN_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"8 JELLYFIN_CUSTOMDATE: "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"9nodes:10 - grok:11 pattern: '(\[%{JELLYFIN_CUSTOMDATE:timestamp}.*\])?.*Authentication request for "?%{JELLYFIN_CUSTOMUSER:username}"? has been denied \(IP: "?%{IP:source_ip}"?\).*'12 apply_on: message13 statics:14 - meta: log_type15 value: jellyfin_failed_auth1617statics:18 - meta: service19 value: jellyfin20 - meta: user21 expression: "evt.Parsed.username"22 - meta: source_ip23 expression: "evt.Parsed.source_ip"24 - target: evt.StrTime25 expression: evt.Parsed.timestamp26