1name: MrShippeR/filebrowser-logs
2description: "Parse Filebrowser authentication failures"
3onsuccess: next_stage
4filter: "evt.Parsed.program == 'filebrowser'"
5
6pattern_syntax:
7  FILEBROWSER_FAILED_AUTH: "%{NGINXERRTIME:event_timestamp} /api/login: 403 %{IP:source_ip} <nil>"
8
9nodes:
10  - grok:
11      name: "FILEBROWSER_FAILED_AUTH"
12      apply_on: message
13      statics:
14        - meta: log_type
15          value: filebrowser_failed_auth
16        - meta: log_subtype
17          value: filebrowser_invalid_credentials
18        - target: evt.StrTime
19          expression: evt.Parsed.event_timestamp
20
21
22statics:
23  - meta: service
24    value: filebrowser
25  - meta: source_ip
26    expression: "evt.Parsed.source_ip"
27  - meta: timestamp
28    expression: "evt.StrTime"
29