cscli parsers install bouddha-fr/opensearch-dashboard-logsParser for Opensearch Dashboard.
Typically you may find other software using this such as Wazuh.
Example acquistion:
1filenames:2 - /path/to/log.txt3labels:4 type: opensearch-dashboards
1filenames:2 - /var/log/syslog3labels:4 type: syslog
1source: journalctl2journalctl_filter:3 - "_SYSTEMD_UNIT=opensearch-dashboards.service"4labels:5 type: syslog
1name: bouddha-fr/opensearch-dashboard-logs2description: "Parse OpenSearch web interface logs for failed login attempts"3filter: "evt.Parsed.program == 'opensearch-dashboards' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'opensearch') in ['', nil]"4onsuccess: next_stage5statics:6 - meta: service7 value: opensearch8 - meta: source_ip9 expression: evt.Unmarshaled.opensearch.req.remoteAddress10 - meta: log_type11 expression: |12 (13 evt.Unmarshaled.opensearch.type == 'response' &&14 evt.Unmarshaled.opensearch.method == 'post' &&15 evt.Unmarshaled.opensearch.statusCode in [401, '401'] &&16 evt.Unmarshaled.opensearch.req.url == '/auth/login?dataSourceId='17 ) ? 'opensearch_failed_auth' : ''18 - meta: timestamp19 expression: evt.Unmarshaled.opensearch['@timestamp']20 - meta: status_code21 expression: evt.Unmarshaled.opensearch.statusCode22 - meta: url23 expression: evt.Unmarshaled.opensearch.req.url24 - target: evt.StrTime25 expression: evt.Unmarshaled.opensearch['@timestamp']26