1onsuccess: next_stage
2#debug: true
3filter: "evt.Parsed.program == 'magento-extension'"
4name: crowdsecurity/magento-extension-logs
5description: "Parse CrowdSec Magento extension logs"
6pattern_syntax:
7  HEADER: '\[%{DATA:timestamp}\] crowdsec-events\.[^:]+:  %{GREEDYDATA:line} \[\]'
8nodes:
9  - grok:
10      name: "HEADER"
11      apply_on: message
12      statics:
13        - target: StrTime
14          expression: evt.Parsed.timestamp
15statics:
16    - meta: service
17      value: magento
18    - meta: log_type
19      expression: JsonExtract(evt.Parsed.line, "type")
20    - meta: source_ip
21      expression: JsonExtract(evt.Parsed.line, "ip")
22    - meta: x_forwarded_for
23      expression: JsonExtract(evt.Parsed.line, "x-forwarded-for-ip")
24    - meta: bouncer_agent
25      expression: JsonExtract(evt.Parsed.line, "bouncer_agent")
26    - meta: customer_id
27      expression: JsonExtract(evt.Parsed.line, "customer_id")
28    - meta: payment_method
29      expression: JsonExtract(evt.Parsed.line, "payment_method")
30    - meta: order_id
31      expression: JsonExtract(evt.Parsed.line, "order_id")
32    - meta: product_id
33      expression: JsonExtract(evt.Parsed.line, "product_id")
34    - meta: quote_id
35      expression: JsonExtract(evt.Parsed.line, "quote_id")