nginx-proxy-manager-logs

1#
2filter: "evt.Parsed.program startsWith 'nginx-proxy-manager'"1
3onsuccess: next_stage2
4name: crowdsecurity/nginx-proxy-manager-logs
5description: "Parse Nginx Proxy Manager access and error logs"
6pattern_syntax:3
7  NGCACHESTATUS: 'HIT|MISS|BYPASS|EXPIRED|STALE|UPDATING|REVALIDATED|-'
8  NUM_OR_DASH: '-|\d*'
9  NO_DOUBLE_QUOTE: '[^"]+'
10  USER_NOT_FOUND: 'user "%{NO_DOUBLE_QUOTE:username}" was not found in "%{NO_DOUBLE_QUOTE}"'
11  PASSWORD_MISMATCH: 'user "%{NO_DOUBLE_QUOTE:username}": password mismatch'
12nodes:4
13  # For Proxy hosts logs (handles both new and legacy formats with optional upstream status)
14  - grok:5
15      pattern: '\[%{HTTPDATE:time_local}\]( %{NGCACHESTATUS:upstream_cache_status} %{NUM_OR_DASH:upstream_status})? %{NUMBER:status} - %{WORD:verb} %{WORD:scheme} %{IPORHOST:target_fqdn} \"%{NOTDQUOTE:request}\" \[Client %{IPORHOST:remote_addr}\] \[Length %{NUMBER:body_bytes_sent}\] \[Gzip %{DATA:gzip_ratio}\]( \[Sent-to %{DATA:target_server}\])? \"%{NOTDQUOTE:http_user_agent}\" \"%{NOTDQUOTE:http_referer}\"'
16      apply_on: message
17      statics:6
18        - meta: log_type
19          value: http_access-log
20        - target: evt.StrTime
21          expression: evt.Parsed.time_local
22  # For Default host logs4
23  - grok:5
24      pattern: '(%{IPORHOST:target_fqdn} )?%{IPORHOST:remote_addr} - (%{NGUSER:remote_user})? \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"( %{NUMBER:request_length} %{NUMBER:request_time} \[%{DATA:proxy_upstream_name}\] \[%{DATA:proxy_alternative_upstream_name}\])?'
25      apply_on: message
26      statics:6
27        - meta: log_type
28          value: http_access-log
29        - target: evt.StrTime
30          expression: evt.Parsed.time_local
31  # and this one the error log4
32  - grok:5
33        pattern: '(%{IPORHOST:target_fqdn} )?%{NGINXERRTIME:time} \[%{LOGLEVEL:loglevel}\] %{NONNEGINT:pid}#%{NONNEGINT:tid}: (\*%{NONNEGINT:cid} )?%{GREEDYDATA:message}, client: %{IPORHOST:remote_addr}, server: %{IPORHOST:target_fqdn}, request: "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:http_version}", host: "%{IPORHOST}"'
34        apply_on: message
35        statics:6
36          - meta: log_type
37            value: http_error-log
38          - target: evt.StrTime
39            expression: evt.Parsed.time
40    onsuccess: next_stage4