cscli parsers install andreasbrett/webmin-logsParser for Webmin logs
1---2filenames:3 - /var/webmin/webmin.log4labels:5 type: Webmin
1onsuccess: next_stage2filter: "Upper(evt.Parsed.program) == 'WEBMIN'"3name: andreasbrett/webmin-logs4description: "Parse webmin logs"5pattern_syntax:6 WEBMIN_AUTH_WRONG_PASS: '%{INT:unix_epoch}\.%{INT}\.%{INT} \[.*\] %{USERNAME:username} - %{IP:source_ip} global miniserv.pl "failed" "-" "wrongpass"'7 WEBMIN_AUTH_TWOFACTOR: '%{INT:unix_epoch}\.%{INT}\.%{INT} \[.*\] %{USERNAME:username} - %{IP:source_ip} global miniserv.pl "failed" "-" "twofactor"'89nodes:10 - grok:11 pattern: "%{WEBMIN_AUTH_WRONG_PASS}"12 apply_on: message13 statics:14 - meta: log_type15 value: webmin_failed_auth_wrong_pass16 - grok:17 pattern: "%{WEBMIN_AUTH_TWOFACTOR}"18 apply_on: message19 statics:20 - meta: log_type21 value: webmin_failed_auth_twofactor2223statics:24 - meta: service25 value: webmin26 - meta: username27 expression: evt.Parsed.username28 - meta: source_ip29 expression: "evt.Parsed.source_ip"30 - target: evt.StrTime31 expression: "evt.Parsed.unix_epoch"32