cscli parsers install LePresidente/redmine-logsParser for Redmine Logs.
1---2filenames:3 - /var/log/production.log4labels:5 type: redmine
1---2source: docker3container_name:4 - Redmine5#container_id:6# - 843ee92d231b7labels:8 type: redmine
1onsuccess: next_stage2#debug: false3name: LePresidente/redmine-logs4description: "Parse redmine logs"5filter: "evt.Parsed.program == 'redmine'"6pattern_syntax:7 REDMINE_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"8nodes:9 - grok:10 pattern: '\[%{TIMESTAMP_ISO8601:timestamp} .*\] %{LOGLEVEL:loglevel} .*: Failed login for \S%{REDMINE_CUSTOMUSER:username}\S from %{IP:source_ip} at %{GREEDYDATA:date}'11 apply_on: message12 statics:13 - meta: log_type14 value: redmine_failed_auth1516statics:17 - meta: service18 value: redmine19 - meta: source_ip20 expression: "evt.Parsed.source_ip"21 - target: evt.StrTime22 expression: "evt.Parsed.timestamp + \"Z\""