adguardhome-logs Log Parser by LePresidente | CrowdSec Hub

adguardhome-logs

Log parser

By: LePresidente
Version: 0.3

Parse adguardhome logs

Install with a top-level collection

1 collection include it

sudo cscli collections install LePresidente/adguardhome

Installs 1 parser and 1 scenario.

View adguardhome →

Installation

sudo cscli parsers install LePresidente/adguardhome-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/LePresidente/adguardhome-logs.yaml· 27 linesGitHub

1onsuccess: next_stage1
2#debug: false
3name: LePresidente/adguardhome-logs
4description: "Parse adguardhome logs"
5filter: "evt.Parsed.program == 'adguardhome'"2
6nodes:3
7  - grok:4
8      pattern: '%{DATE_X:date} %{TIME:time}.* POST %{HOSTNAME} /control/login: from ip %{IP:source_ip}: invalid username or password$'
9      apply_on: message
10      statics:5
11        - meta: log_type
12          value: adguardhome_failed_auth
13  - grok:4
14      pattern: '%{DATE_X:date} %{TIME:time}.* POST %{IP:source_ip} /control/login: invalid username or password$'
15      apply_on: message
16      statics:5
17        - meta: log_type
18          value: adguardhome_failed_auth
19
20
21statics:
22    - meta: service
23      value: adguardhome
24    - meta: source_ip
25      expression: "evt.Parsed.source_ip"
26    - target: evt.StrTime
27      expression: "evt.Parsed.date + ' ' + evt.Parsed.time"

Installed on

Know where it runs

Documentation

Parser for AdGuardHome Logs.

1---
2filenames:
3 - /var/log/AdGuardHome.log
4labels:
5  type: adguardhome

1---
2source: docker
3container_name:
4 - AdGuardHome
5#container_id:
6# - 843ee92d231b
7labels:
8  type: adguardhome