cscli parsers install ZoeyVid/npmplus-logsA generic parser for NPMplus, supports both access and error logs.
1filter: "evt.Parsed.program startsWith 'npmplus'"2onsuccess: next_stage3name: ZoeyVid/npmplus-logs4description: "Parse NPMplus access logs"5nodes:6 - grok:7 pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}" "%{NOTDQUOTE:remote_user}"'8 apply_on: message9 statics:10 - meta: log_type11 value: http_access-log12 - target: evt.StrTime13 expression: evt.Parsed.time_local14 onsuccess: next_stage15 nodes:16 - filter: "evt.Parsed.status == '401' && evt.Parsed.remote_user != '-'"17 statics:18 - meta: sub_type19 value: "auth_fail"20 - meta: username21 expression: evt.Parsed.remote_user22 ## Parse malformed requests23 - grok:24 pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{DATA:request}" %{NUMBER:status} %{NUMBER} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}" "%{NOTDQUOTE:remote_user}"'25 apply_on: message26 statics:27 - meta: log_type28 value: http_access-log29 - target: evt.StrTime30 expression: evt.Parsed.time_local3132 ## Parse the old access log format and error logs33 - grok:34 pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER} %{NUMBER} %{DATA:http_referer} %{GREEDYDATA:http_user_agent}'35 apply_on: message36 statics:37 - meta: log_type38 value: http_access-log39 - target: evt.StrTime40 expression: evt.Parsed.time_local41 ## Parse malformed requests42 - grok:43 pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{DATA:request}" %{NUMBER:status} %{NUMBER} %{NUMBER} %{DATA:http_referer} %{GREEDYDATA:http_user_agent}'44 apply_on: message45 statics:46 - meta: log_type47 value: http_access-log48 - target: evt.StrTime49 expression: evt.Parsed.time_local50 - grok:51 # and this one the error log52 pattern: '(%{IPORHOST} )?%{NGINXERRTIME:time} \[%{LOGLEVEL}\] %{NONNEGINT}#%{NONNEGINT}: (\*%{NONNEGINT} )?%{GREEDYDATA:message}, client: %{IPORHOST:remote_addr}, server: %{DATA}, request: "%{WORD:verb} ([^/]+)?%{DATA:request}( HTTP/%{NUMBER:http_version})?"(?:, subrequest: "%{NOTDQUOTE}")?(?:, upstream: "%{NOTDQUOTE}")?(?:, host: "%{DATA:target_fqdn}(?::%{NONNEGINT})?")?'53 apply_on: message54 statics:55 - meta: log_type56 value: http_error-log57 - target: evt.StrTime58 expression: evt.Parsed.time59 pattern_syntax:60 NO_DOUBLE_QUOTE: '[^"]+'61 onsuccess: next_stage62 nodes:63 - filter: "evt.Parsed.message contains 'was not found in'"64 pattern_syntax:65 USER_NOT_FOUND: 'user "%{NO_DOUBLE_QUOTE:username}" was not found in "%{NO_DOUBLE_QUOTE}"'66 grok:67 pattern: '%{USER_NOT_FOUND}'68 apply_on: message69 statics:70 - meta: sub_type71 value: "auth_fail"72 - meta: username73 expression: evt.Parsed.username74 - filter: "evt.Parsed.message contains 'password mismatch'"75 pattern_syntax:76 PASSWORD_MISMATCH: 'user "%{NO_DOUBLE_QUOTE:username}": password mismatch'77 grok:78 pattern: '%{PASSWORD_MISMATCH}'79 apply_on: message80 statics:81 - meta: sub_type82 value: "auth_fail"83 - meta: username84 expression: evt.Parsed.username85 - filter: "evt.Parsed.message contains 'limiting requests, excess'"86 statics:87 - meta: sub_type88 value: "req_limit_exceeded"8990# these ones apply for all grok patterns91statics:92 - meta: service93 value: http94 - meta: source_ip95 expression: "evt.Parsed.remote_addr"96 - meta: http_status97 expression: "evt.Parsed.status"98 - meta: http_path99 expression: "evt.Parsed.request"100 - meta: http_verb101 expression: "evt.Parsed.verb"102 - meta: http_user_agent103 expression: "evt.Parsed.http_user_agent"104 - meta: target_fqdn105 expression: "evt.Parsed.target_fqdn"106