1onsuccess: next_stage
2#debug: false
3name: LePresidente/ombi-logs
4description: "Parse ombi logs"
5filter: "evt.Parsed.program == 'ombi'"
6nodes:
7  - grok:
8      pattern: '%{TIMESTAMP_ISO8601:timestamp}.*?Failed login attempt by IP: %{IP:source_ip}'
9      
10      apply_on: message
11      statics:
12        - meta: log_type
13          value: ombi_auth_failed
14
15statics:
16    - meta: service
17      value: ombi
18    - meta: source_ip
19      expression: "evt.Parsed.source_ip"
20    - target: evt.StrTime
21      expression: evt.Parsed.timestamp