Installation
sudo cscli parsers install crowdsecurity/cri-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Line.Labels.type == 'containerd'"onsuccess: next_stagename: crowdsecurity/cri-logsdescription: CRI logging format parsernodes:- grok:pattern: "^%{TIMESTAMP_ISO8601:cri_timestamp} %{WORD:stream} %{WORD:logtag} %{GREEDYDATA:message}"apply_on: Line.Rawstatics:- parsed: "logsource"value: "cri"- target: evt.StrTimeexpression: evt.Parsed.cri_timestamp- parsed: programexpression: evt.Line.Labels.program- meta: datasource_pathexpression: evt.Line.Src- meta: datasource_typeexpression: evt.Line.Module
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
CRI log format parser
This is the default CRI logs format parser. It works on kubernetes using containerd.
requirements
When using this parser, you need to specify in your acquis.yaml type and program. So your log will be extracted and then sent to the proper next parser using the program key.
example:
1labels:2 type: containerd3 program: nginx