cscli parsers install a1ad/meshcentral-logsParser for Meshcentral Auth Logs.
You need to add the following in the Meshcentral config file before Meshcentral starts logging: "authLog": "/opt/meshcentral/meshcentral-data/auth.log"
1---2filenames:3 - /opt/meshcentral/meshcentral-data/auth.log4labels:5 type: meshcentral
12onsuccess: next_stage3#debug: false4name: a1ad/meshcentral-logs5description: "Parse meshcentral logs"6filter: "evt.Parsed.program == 'meshcentral'"7pattern_syntax:8 MESHCENTRAL_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"9 MESHCENTRAL_CUSTOMDATE: "%{MONTH} %{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"10nodes:11 - grok:12 pattern: '%{MESHCENTRAL_CUSTOMDATE:timestamp}.*Failed password for %{MESHCENTRAL_CUSTOMUSER:username} from %{IP:source_ip}.*'13 apply_on: message14 statics:15 - meta: log_type16 value: meshcentral_failed_auth1718statics:19 - meta: service20 value: meshcentral21 - meta: user22 expression: "evt.Parsed.username"23 - meta: source_ip24 expression: "evt.Parsed.source_ip"25 - target: evt.StrTime26 expression: evt.Parsed.timestamp27