cscli parsers install baudneo/gotify-logsA parser that will search for unauthorized (401) status code in a log file that gotify is outputting its stdout to. From testing it seems gotify returns a 401 for unknown user, bad password, and incorrect tokens. There is no way to determine which is which so this parser will only search for 401 status code.
acquis.yaml entry - The type MUST be exactly as shown here or the parser will never be successful.1filenames:2 - /path/to/gotify.log3labels:4 type: gotify
❗ The type MUST be gotify ❗
evt.Parsed.source_ip and evt.Meta.source_ipDockerfile and then build it. Example Dockerfile as follows.1FROM gotify/server2ENTRYPOINT /bin/bash -c '/app/gotify-app | tee /app/data/gotify.log'
sudo docker build -t <TAG NAME><TAG NAME> - server/gotify:loggergotify_data directory1 gotify:2 image: gotify/server:logger3 container_name: gotify4 restart: always5 ports:6 - 8080:807 volumes:8 - "./gotify_data:/app/data"9
1#filter: '1 == 1' # For hub tests2filter: evt.Parsed.program == "gotify" # Production3#debug: true4onsuccess: next_stage5name: baudneo/gotify-logs6description: parser for Gotify server7pattern_syntax:8 GOTIFY_SEPERATOR: '%{SPACE}\|%{SPACE}'9 GOTIFY_401: '^\[GIN\]\s*%{YEAR:year}/%{MONTHNUM:month}/%{NUMBER:day}%{SPACE}[-]%{SPACE}%{TIME:time}%{GOTIFY_SEPERATOR}401%{GOTIFY_SEPERATOR}%{DATA:request_time_took}%{GOTIFY_SEPERATOR}%{IP:source_ip}%{GOTIFY_SEPERATOR}%{WORD:request_type}%{SPACE}"%{DATA:endpoint}"'10nodes:11 - grok:12 name: "GOTIFY_401"13 apply_on: message14 statics:15 - target: StrTime16 expression: |-17 evt.Parsed.year+ "/" + evt.Parsed.month + "/" + evt.Parsed.day + " " + evt.Parsed.time18 - grok:19 pattern: '%{TIMESTAMP_ISO8601:timestamp}%{GOTIFY_SEPERATOR}401%{GOTIFY_SEPERATOR}%{DATA:request_time_took}%{GOTIFY_SEPERATOR}%{IP:source_ip}%{GOTIFY_SEPERATOR}%{WORD:request_type}%{SPACE}"%{DATA:endpoint}"'20 apply_on: message21 statics:22 - target: StrTime23 expression: evt.Parsed.timestamp24statics:25 - meta: source_ip26 expression: evt.Parsed.source_ip27 - meta: log_type28 value: gotify_failed_auth29