1name: LearningSpot/litellm-logs
2description: "Parse Litellm login logs"
3filter: "evt.Parsed.program == 'litellm'"
4onsuccess: next_stage
5nodes:
6  - grok:
7      pattern: 'INFO:%{SPACE}%{IP:source_ip}:%{INT} - "%{WORD:method} %{DATA:query} %{URIPROTO}/%{NUMBER:http_version}" %{NUMBER:status} Unauthorized'
8      apply_on: message
9      statics:
10        - meta: log_type
11          value: litellm_failed_auth
12statics:
13  - meta: service
14    value: litellm
15  - target: source_ip
16    expression: evt.Parsed.source_ip
17  - meta: status
18    expression: evt.Parsed.status
19