1onsuccess: next_stage
2#debug: false
3name: LePresidente/overseerr-logs
4description: "Parse Overseerr logs"
5filter: "evt.Parsed.program == 'overseerr'"
6pattern_syntax:
7  OVERSEERR_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"
8nodes:
9  - grok:
10      pattern: '(%{RFC3339:timestamp})?.*Failed sign-in attempt using invalid .* password.*{"ip":"::ffff:%{IP:source_ip}","email":"%{OVERSEERR_CUSTOMUSER:username}"}'
11      apply_on: message
12      statics:
13        - meta: log_type
14          value: overseerr_failed_auth
15  - grok:
16      pattern: '(%{RFC3339:timestamp})?.*Failed login attempt from user with incorrect.*credentials {"account":{"ip":"::ffff:%{IP:source_ip}","email":"%{OVERSEERR_CUSTOMUSER:username}","password":"__REDACTED__"}}'
17      apply_on: message
18      statics:
19        - meta: log_type
20          value: overseerr_failed_auth
21  - grok:
22      pattern: '(%{RFC3339:timestamp})?.*Failed sign-in attempt using invalid .* password.*{"ip":"%{IP:source_ip}","email":"%{OVERSEERR_CUSTOMUSER:username}"}'
23      apply_on: message
24      statics:
25        - meta: log_type
26          value: overseerr_failed_auth
27  - grok:
28      pattern: '(%{RFC3339:timestamp})?.*Failed login attempt from user with incorrect.*credentials {"account":{"ip":"%{IP:source_ip}","email":"%{OVERSEERR_CUSTOMUSER:username}","password":"__REDACTED__"}}'
29      apply_on: message
30      statics:
31        - meta: log_type
32          value: overseerr_failed_auth
33statics:
34    - meta: service
35      value: overseerr
36    - meta: source_ip
37      expression: "evt.Parsed.source_ip"
38    - meta: user
39      expression: "evt.Parsed.username"
40    - target: evt.StrTime
41      expression: evt.Parsed.timestamp