cscli parsers install crowdsecurity/syslog-logsThis is a generic linux syslog parser with time-support.
Add datasource_type and datasource_path source and datasource type in the Meta object.
1#If it's syslog, we are going to extract progname from it2filter: "evt.Line.Labels.type == 'syslog'"3onsuccess: next_stage4pattern_syntax:5 RAW_SYSLOG_PREFIX: '^<%{NUMBER:syslog_priority}>%{NUMBER:syslog_version} %{SYSLOGBASE2} %{DATA:program} (?:%{NUMBER:pid}|-)'6 RAW_SYSLOG_META: '\[meta sequenceId="%{NOTDQUOTE:seq_id}"\]'7name: crowdsecurity/syslog-logs8nodes:9 - grok:10 #this is a named regular expression. grok patterns can be kept into separate files for readability11 pattern: "^%{SYSLOGLINE}"12 #This is the field of the `Event` to which the regexp should be applied13 apply_on: Line.Raw14 - grok:15 #RFC5424 syslog format (used by pfSense and OPNsense with alternative logging)16 pattern: '%{RAW_SYSLOG_PREFIX} - (?:%{RAW_SYSLOG_META} |- )%{GREEDYDATA:message}'17 apply_on: Line.Raw18#if the node was successfull, statics will be applied.19statics:20 - meta: machine21 expression: evt.Parsed.logsource22 - parsed: "logsource"23 value: "syslog"24# syslog date can be in two different fields (one of hte assignment will fail)25 - target: evt.StrTime26 expression: evt.Parsed.timestamp27 - target: evt.StrTime28 expression: evt.Parsed.timestamp860129 - meta: datasource_path30 expression: evt.Line.Src31 - meta: datasource_type32 expression: evt.Line.Module33---34#if it's not syslog, the type is the progname35filter: "evt.Line.Labels.type not in ['syslog', 'unifi']"36onsuccess: next_stage37name: crowdsecurity/non-syslog38#debug: true39statics:40 - parsed: message41 expression: evt.Line.Raw42 - parsed: program43 expression: evt.Line.Labels.type44 - meta: datasource_path45 expression: evt.Line.Src46 - meta: datasource_type47 expression: evt.Line.Module4849