authelia-logs

1debug: false
2name: LePresidente/authelia-logs
3filter: "evt.Parsed.program == 'authelia'"1
4description: "Parse Authelia logs"
5pattern_syntax:2
6  AUTHELIA_USER: '%{EMAILADDRESS}|%{USERNAME}'
7nodes:3
8  ## Main parsing section either it key value pairs or JSON
9  - filter: TrimSpace(evt.Parsed.message) not startsWith "{" && ParseKV(evt.Parsed.message, evt.Unmarshaled, "authelia") in ["", nil]
10    statics:4
11      - meta: log_format
12        value: CLF
13  - filter: evt.Unmarshaled.authelia == nil && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "authelia") in ["", nil]3
14    statics:4
15      - meta: log_format
16        value: JSON
17
18  ## Detect msg contans authentication attempt to parse out user info3
19  - grok:5
20      pattern: "%{WORD:auth_status} (1FA|Duo|TOTP|U2F) authentication attempt (made )?by user '%{AUTHELIA_USER:user}'" 
21      expression: evt.Unmarshaled.authelia.msg
22    statics:4
23      - meta: log_type
24        expression: 'evt.Parsed.auth_status == "Unsuccessful" ? "auth_failed" : "auth_success"'
25
26  - grok:5
27      pattern: "Error .* getting details for user with username input '%{AUTHELIA_USER:user}'.*" 
28      expression: evt.Unmarshaled.authelia.msg
29    statics:4
30      - meta: log_type
31        value: auth_failed
32
33  ## This section is a hack to allow all authelia logs to pass to next stage, if you set onsuccess next stage at root level all successful attempts will not be passed, so we could do some impossible trave sceanrios3
34  - filter: evt.Unmarshaled.authelia != nil
35    onsuccess: next_stage6
36    statics:4
37      - meta: service
38        value: authelia
39statics:
40    - meta: user