cscli parsers install crowdsecurity/fastly-logsParser for fastly logs with default format (see faslty documentation)
Mandatory You need to add those labels on the acquisition:
1labels:2 type: syslog3 external_format: fastly
1filter: "evt.Line.Labels.external_format == 'fastly'"2onsuccess: next_stage3#debug: true4name: crowdsecurity/fastly-logs5description: fastly logs parser6pattern_syntax:7 DOUBLE_NUM: "[0-9]{2}"8grok:9 pattern: "%{GREEDYDATA:fastly_timestamp}\\+%{DOUBLE_NUM:tz_part1}%{DOUBLE_NUM:tz_part2}"10 expression: JsonExtract(evt.Parsed.message, "timestamp")11statics:12 - meta: service13 value: http14 - meta: log_type15 value: http_access-log16 - target: evt.StrTime17 expression: evt.Parsed.fastly_timestamp + ".00+" + evt.Parsed.tz_part1 + ":" + evt.Parsed.tz_part218 - meta: source_ip19 expression: JsonExtract(evt.Parsed.message, "client_ip")20 - target: evt.Parsed.request21 expression: JsonExtract(evt.Parsed.message, "url")22 - meta: http_path23 expression: JsonExtract(evt.Parsed.message, "url")24 - parsed: verb25 expression: JsonExtract(evt.Parsed.message, "request_method")26 - meta: verb27 expression: JsonExtract(evt.Parsed.message, "request_method")28 - parsed: http_referer29 expression: JsonExtract(evt.Parsed.message, "request_referer")30 - parsed: http_user_agent31 expression: JsonExtract(evt.Parsed.message, "request_user_agent")32 - meta: http_user_agent33 expression: JsonExtract(evt.Parsed.message, "request_user_agent")34 - meta: http_status35 expression: JsonExtract(evt.Parsed.message, "response_status")36 - parsed: body_bytes_sent37 expression: JsonExtract(evt.Parsed.message, "response_body_size")