apache2-logs

1#Apache access/errors logs
2#debug: true
3filter: "evt.Parsed.program startsWith 'apache2'"1
4onsuccess: next_stage2
5name: crowdsecurity/apache2-logs
6description: "Parse Apache2 access and error logs"
7#log line can be prefixed by a target_fqdn
8nodes:3
9  - grok:4
10      pattern: '(%{IPORHOST:target_fqdn}(:%{INT:port})? )?%{COMMONAPACHELOG}( "%{NOTDQUOTE:referrer}" "%{NOTDQUOTE:http_user_agent}")?'
11      apply_on: message
12      # these ones apply for both grok patterns
13      statics:5
14        - meta: log_type
15          value: http_access-log
16        - target: evt.StrTime
17          expression: evt.Parsed.timestamp
18        - meta: service
19          value: http
20        - meta: source_ip
21          expression: evt.Parsed.clientip
22        - meta: http_status
23          expression: evt.Parsed.response
24        - meta: http_path
25          expression: "evt.Parsed.request != '' ? evt.Parsed.request : evt.Parsed.rawrequest"
26        - meta: http_verb
27          expression: "evt.Parsed.verb"
28        - meta: http_user_agent
29          expression: "evt.Parsed.http_user_agent"
30        - meta: target_fqdn
31          expression: "evt.Parsed.target_fqdn"
32    onsuccess: next_stage3
33  - grok:4
34      pattern: '%{HTTPD_ERRORLOG}'
35      apply_on: message
36    onsuccess: next_stage3
37    pattern_syntax:6
38      NOT_DOUBLE_POINT: '[^:]+'
39      NOT_DOUBLE_QUOTE: '[^"]+'    
40    nodes:3