cscli parsers install LePresidente/adguardhome-logsParser for AdGuardHome Logs.
1---2filenames:3 - /var/log/AdGuardHome.log4labels:5 type: adguardhome
1---2source: docker3container_name:4 - AdGuardHome5#container_id:6# - 843ee92d231b7labels:8 type: adguardhome
1onsuccess: next_stage2#debug: false3name: LePresidente/adguardhome-logs4description: "Parse adguardhome logs"5filter: "evt.Parsed.program == 'adguardhome'"6nodes:7 - grok:8 pattern: '%{DATE_X:date} %{TIME:time}.* POST %{HOSTNAME} /control/login: from ip %{IP:source_ip}: invalid username or password$'9 apply_on: message10 statics:11 - meta: log_type12 value: adguardhome_failed_auth13 - grok:14 pattern: '%{DATE_X:date} %{TIME:time}.* POST %{IP:source_ip} /control/login: invalid username or password$'15 apply_on: message16 statics:17 - meta: log_type18 value: adguardhome_failed_auth192021statics:22 - meta: service23 value: adguardhome24 - meta: source_ip25 expression: "evt.Parsed.source_ip"26 - target: evt.StrTime27 expression: "evt.Parsed.date + ' ' + evt.Parsed.time"