1onsuccess: next_stage
2
3name: LePresidente/jellyseerr-logs
4description: "Parse jellyseerr logs"
5filter: "evt.Parsed.program == 'jellyseerr'"
6pattern_syntax:
7 JELLYSEERR_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"
8nodes:
9 - grok:
10 pattern: '%{RFC3339:timestamp}.*Failed sign-in attempt using invalid .* password.*{"ip":"::ffff:%{IP:source_ip}","email":"%{JELLYSEERR_CUSTOMUSER:username}"}'
11 apply_on: message
12 statics:
13 - meta: log_type
14 value: jellyseerr_failed_auth
15 - grok:
16 pattern: '%{RFC3339:timestamp}.*Failed login attempt from user with incorrect.*credentials {"account":{"ip":"::ffff:%{IP:source_ip}","email":"%{JELLYSEERR_CUSTOMUSER:username}","password":"__REDACTED__"}}'
17 apply_on: message
18 statics:
19 - meta: log_type
20 value: jellyseerr_failed_auth
21 - grok:
22 pattern: '%{RFC3339:timestamp}.*Failed sign-in attempt using invalid .* password.*{"ip":"%{IP:source_ip}","email":"%{JELLYSEERR_CUSTOMUSER:username}"}'
23 apply_on: message
24 statics:
25 - meta: log_type
26 value: jellyseerr_failed_auth
27 - grok:
28 pattern: '%{RFC3339:timestamp}.*Failed login attempt from user with incorrect.*credentials {"account":{"ip":"%{IP:source_ip}","email":"%{JELLYSEERR_CUSTOMUSER:username}","password":"__REDACTED__"}}'
29 apply_on: message
30 statics:
31 - meta: log_type
32 value: jellyseerr_failed_auth
33
34statics:
35 - meta: service
36 value: jellyseerr
37 - meta: source_ip
38 expression: "evt.Parsed.source_ip"
39 - meta: user
40 expression: "evt.Parsed.username"
41 - target: evt.StrTime
42 expression: evt.Parsed.timestamp
