cscli parsers install aidalinfo/tcpudp-flood-traefikExample acquisition for parser aidalinfo/tcpudp-flood-traefik :
1---2filenames:3- /var/log/*/traefik-debug.log4labels:5 type: tcpudp-traefik
1onsuccess: next_stage2## Facilite le débogage3## EN: Enable debugging4debug: false5## Nom de la tâche6## EN: Task name7name: aidalinfo/tcpudp-flood-traefik8## Description de la tâche9## EN: Task description10description: "Parse TCP/UDP traefik logs"11## filtre du log à traiter12## EN: Log filter to process13filter: "evt.Parsed.program == 'tcpudp-traefik'"14## Liste des nœuds15## EN: List of nodes16nodes:17## TCP GROK18 - grok:19 ## Grok pattern for extract IP SOURCE and other informations on this message structure20 pattern: 'time="%{TIMESTAMP_ISO8601:time}" level=%{LOGLEVEL:level} msg="Handling TCP connection from %{IP:source_ip}:%{NUMBER:source_port} to %{IP:destination_ip}:%{NUMBER:destination_port}"'21 ## Apply pattern on for all message in logs22 apply_on: message23 statics:24 ## Add meta value, this type is used by scenario25 - meta: log_type26 value: traefik_tcpudp27## UDP GROK pattern for extract IP SOURCE and other informations on this message structure28 - grok:29 pattern: 'time="%{TIMESTAMP_ISO8601:time}" level=%{LOGLEVEL:level} msg="Handling UDP stream from %{IP:source_ip}:%{NUMBER:source_port} to %{IP:destination_ip}:%{NUMBER:destination_port}"'30 ## Apply pattern on for all message in logs31 apply_on: message32 statics:33 ## Add meta value, this type is used by scenario34 - meta: log_type35 value: traefik_tcpudp36statics:37## Pass Time and Source IP to other stages and scenarios.38 - meta: source_ip39 expression: "evt.Parsed.source_ip"40 - target: evt.StrTime41 expression: evt.Parsed.time42