npmplus-logs

1filter: "evt.Parsed.program startsWith 'npmplus'"1
2onsuccess: next_stage2
3name: ZoeyVid/npmplus-logs
4description: "Parse NPMplus access logs"
5nodes:3
6  - grok:4
7      pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}" "%{NOTDQUOTE:remote_user}"'
8      apply_on: message
9      statics:5
10        - meta: log_type
11          value: http_access-log
12        - target: evt.StrTime
13          expression: evt.Parsed.time_local
14    onsuccess: next_stage3
15    nodes:
16      - filter: "evt.Parsed.status == '401' && evt.Parsed.remote_user != '-'"
17        statics:
18          - meta: sub_type
19            value: "auth_fail"
20          - meta: username
21            expression: evt.Parsed.remote_user
22  ## Parse malformed requests
23  - grok:4
24      pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{DATA:request}" %{NUMBER:status} %{NUMBER} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}" "%{NOTDQUOTE:remote_user}"'
25      apply_on: message
26    statics:3
27      - meta: log_type
28        value: http_access-log
29      - target: evt.StrTime
30        expression: evt.Parsed.time_local
31
32  ## Parse the old access log format and error logs
33  - grok:4
34      pattern: '\[%{HTTPDATE:time_local}\] %{DATA:target_fqdn}(?::%{NONNEGINT})? %{IPORHOST:remote_addr} %{NUMBER} "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER} %{NUMBER} %{DATA:http_referer} %{GREEDYDATA:http_user_agent}'
35      apply_on: message
36      statics:5
37        - meta: log_type
38          value: http_access-log
39        - target: evt.StrTime
40          expression: evt.Parsed.time_local