cscli parsers install crowdsecurity/cri-logsThis is the default CRI logs format parser. It works on kubernetes using containerd.
When using this parser, you need to specify in your acquis.yaml type and program. So your log will be extracted and then sent to the proper next parser using the program key.
example:
1labels:2 type: containerd3 program: nginx
1filter: "evt.Line.Labels.type == 'containerd'"2onsuccess: next_stage3name: crowdsecurity/cri-logs4description: CRI logging format parser5nodes:6 - grok:7 pattern: "^%{TIMESTAMP_ISO8601:cri_timestamp} %{WORD:stream} %{WORD:logtag} %{GREEDYDATA:message}"8 apply_on: Line.Raw9statics:10 - parsed: "logsource"11 value: "cri"12 - target: evt.StrTime13 expression: evt.Parsed.cri_timestamp14 - parsed: program15 expression: evt.Line.Labels.program16 - meta: datasource_path17 expression: evt.Line.Src18 - meta: datasource_type19 expression: evt.Line.Module