1onsuccess: next_stage
2#debug: false
3name: LePresidente/emby-logs
4description: "Parse emby logs"
5filter: "evt.Parsed.program == 'emby'"
6nodes:
7  - grok:
8      pattern: '%{TIMESTAMP_ISO8601:timestamp}.*?AUTH-ERROR: %{IP:source_ip} - Invalid username or password entered\.$'
9      apply_on: message
10      statics:
11        - meta: log_type
12          value: emby_failed_auth
13
14statics:
15    - meta: service
16      value: emby
17    - meta: source_ip
18      expression: "evt.Parsed.source_ip"
19    - target: evt.StrTime
20      expression: evt.Parsed.timestamp