cscli parsers install cbrandlehner/mailscanner-logs1name: cbrandlehner/mailscanner-logs2description: Parse MailScanner logs (spam and blacklist)3onsuccess: next_stage4filter: "evt.Parsed.program == 'MailScanner'"5nodes:6 - grok:7 pattern: 'Message %{NOTSPACE:message_id} from %{IP:source_ip} \(%{EMAILADDRESS:from_email}\) to %{NOTSPACE:to_domain} is spam.*(score|Wertung)=%{NUMBER:spam_score}'8 apply_on: message9 statics:10 - meta: log_type11 value: mailscanner_spam12 - parsed: spam_score13 expression: float(evt.Parsed.spam_score)14 - grok:15 pattern: 'Message %{NOTSPACE:message_id} from %{IP:source_ip} \(%{EMAILADDRESS:from_email}\) to %{NOTSPACE:to_domain} is spam \(%{WORD:spam_reason}\)'16 apply_on: message17 statics:18 - meta: log_type19 value: mailscanner_blacklist20 - parsed: spam_reason21 expression: evt.Parsed.spam_reason2223statics:24 - meta: source_ip25 expression: evt.Parsed.source_ip26