cscli parsers install LePresidente/harbor-logsParser for Harbor Logs.
1---2filenames:3 - /var/log/harbor/core.log4labels:5 type: harbor
1onsuccess: next_stage2debug: false3name: LePresidente/harbor-logs4filter: "evt.Parsed.program == 'harbor'"5description: "Parse Harbor logs"6pattern_syntax:7 HARBOR_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"8nodes:9 - grok:10 pattern: '.*core\[%{GREEDYDATA:PID}\]: %{RFC3339:timestamp} \[%{GREEDYDATA:ERROR}\] .*\[client IP="%{IP:remote_ip}, %{IP:internal_ip}".*failed to authenticate user:%{HARBOR_CUSTOMUSER:username}, error:Failed to authenticate user, due to error \SInvalid credentials\S'11 apply_on: message12 statics:13 - meta: log_type14 value: harbor_failed_auth15statics:16 - meta: service17 value: harbor18 - meta: user19 expression: "evt.Parsed.username"20 - target: evt.StrTime21 expression: evt.Parsed.timestamp22 - meta: source_ip23 expression: "evt.Parsed.remote_ip"