dateparse-enrich
Log parser
- Version
- 0.2
Install with a top-level collection
12 collections include itsudo cscli collections install ZoeyVid/npmplusInstalls 5 parsers and 54 scenarios.
View NPMplus →Installation
sudo cscli parsers install crowdsecurity/dateparse-enrichThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.StrTime != ''"name: crowdsecurity/dateparse-enrich#debug: true#it's a hack lolstatics:- method: ParseDateexpression: evt.StrTime- target: MarshaledTimeexpression: evt.Enriched.MarshaledTime- meta: timestampexpression: evt.Enriched.MarshaledTime
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Parses timestamp strings in logs to be used in forensic mode. The parser supports the following formats, or the one provided in StrTimeFormat :
- RFC3339
02/Jan/2006:15:04:05 -0700Mon Jan 2 15:04:05 200602-Jan-2006 15:04:05 europe/paris01/02/2006 15:04:052006-01-02 15:04:05.999999999 -0700 MSTJan 2 15:04:05Mon Jan 02 15:04:05.000000 20062006-01-02T15:04:05Z07:002006/01/022006/01/02 15:042006-01-022006-01-02 15:04
The StrTime item of the event is parsed by default. See crowdsecurity/syslog-logs as an example of a parser setting this field for crowdsecurity/dateparse-enrich.
If a date layout is present in the StrTimeFormat field of the event, it will take precedence over the list above. The date layout must be (valid in the golang's time.Parse layout format), allowing parsers to specify the date format for later parsing :
1filter: ...2...3statics:4 - target: evt.StrTimeFormat5 value: "2006 2 15.04.05 Jan"6...
This allows crowdsecurity/dateparse-enrich to parse dates in this format for this log type.