cscli parsers install LePresidente/jellyfin-logsParser for Jellyfin Logs.
1---2filenames:3 - /var/log/jellyfin/log_*.log4labels:5 type: jellyfin
Note: If you are using Docker logs (directly or sending them to a syslog server), the output format is incorrect and will not match.
Create a copy of logging.default.json to logging.json in Jellyfin config directory (it will override the logging.default.json) and change the console output template like the following :
1...2 "WriteTo": [3 {4 "Name": "Console",5 "Args": {6 "outputTemplate": "[{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz}] [{Level:u3}] [{ThreadId}] {SourceContext}: {Message:lj}{NewLine}{Exception}"7 }8 },9...
1onsuccess: next_stage2#debug: false3name: LePresidente/jellyfin-logs4description: "Parse jellyfin logs"5filter: "evt.Parsed.program == 'jellyfin'"6pattern_syntax:7 JELLYFIN_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"8 JELLYFIN_CUSTOMDATE: "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"9nodes:10 - grok:11 pattern: '(\[%{JELLYFIN_CUSTOMDATE:timestamp}.*\])?.*Authentication request for "?%{JELLYFIN_CUSTOMUSER:username}"? has been denied \(IP: "?%{IP:source_ip}"?\).*'12 apply_on: message13 statics:14 - meta: log_type15 value: jellyfin_failed_auth1617statics:18 - meta: service19 value: jellyfin20 - meta: user21 expression: "evt.Parsed.username"22 - meta: source_ip23 expression: "evt.Parsed.source_ip"24 - target: evt.StrTime25 expression: evt.Parsed.timestamp26