cscli parsers install LePresidente/grafana-logsParser for Grafana Logs.
1---2filenames:3 - /var/log/grafana/grafana.log4labels:5 type: grafana
1---2source: docker3container_name:4 - grafana5#container_id:6# - 843ee92d231b7labels:8 type: grafana
1#debug: false2name: LePresidente/grafana-logs3filter: "evt.Parsed.program == 'grafana'"4description: "Parse grafana logs"5pattern_syntax:6 GRAFANA_AUTH_WORD: (Unauthorized|Invalid|Successful)7nodes:8 ## Main parsing section either it key value pairs or JSON9 - filter: TrimSpace(evt.Parsed.message) not startsWith "{" && ParseKV(evt.Parsed.message, evt.Unmarshaled, "grafana") in ["", nil]10 statics:11 - meta: log_format12 value: CLF13 - filter: evt.Unmarshaled.grafana == nil && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "grafana") in ["", nil]14 statics:15 - meta: log_format16 value: JSON1718 ## Detect msg contans authentication attempt to parse out user info19 - grok:20 pattern: "%{GRAFANA_AUTH_WORD:auth_status}( username or password)?"21 expression: evt.Unmarshaled.grafana.msg22 statics:23 - meta: log_type24 expression: 'evt.Parsed.auth_status == "Unauthorized" || evt.Parsed.auth_status == "Invalid" ? "auth_failed" : "auth_success"'2526 ## We filter to see if we have a log_type set from above, if not we detect if new log format27 - filter: evt.Meta.log_type == ''28 statics:29 - meta: log_type30 expression: 'evt.Unmarshaled.grafana.errorMessageID == "password-auth.failed" && evt.Unmarshaled.grafana.errorReason in ["Unauthorized", "Invalid"] ? "auth_failed" : "auth_success"'3132 ## This section is a hack to allow all grafana logs to pass to next stage, if you set onsuccess next stage at root level all successful attempts will not be passed, so we could do some impossible trave sceanrios33 - filter: evt.Unmarshaled.grafana != nil34 onsuccess: next_stage35 statics:36 - meta: service37 value: grafana38statics:39 - target: evt.StrTime40 expression: evt.Unmarshaled.grafana.t41 - meta: source_ip42 expression: evt.Unmarshaled.grafana.remote_addr43