cscli parsers install crowdsecurity/traefik-logsCo-authored with (https://github.com/gmelodie)
This traefik parser supports access logs in the Common Log Format (defined here for Traefik) and JSON formats.
1# co-authored with gmelodie (https://github.com/gmelodie)2name: crowdsecurity/traefik-logs3description: "Parse Traefik access logs"4filter: "evt.Parsed.program startsWith 'traefik'"5#debug: true6onsuccess: next_stage7pattern_syntax:8 TRAEFIK_ROUTER: '(%{USER}@%{URIHOST}|\-)'9 TRAEFIK_SERVER_URL: '(%{URI}|\-)'10 NUMBER_MINUS: '[0-9-]+'11 NGCUSTOMUSER: '[a-zA-Z0-9\.\@\-\+_%]+'12 NGINXACCESS2: '%{IPORHOST:remote_addr} - %{NGCUSTOMUSER:remote_user} \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER_MINUS:status} %{NUMBER_MINUS:body_bytes_sent} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"'13nodes:14 ## CLF parser - extract fields and store full router chain in traefik_router_name (backwards compatible)15 - grok:16 pattern: '%{NGINXACCESS2} %{NUMBER:number_of_requests_received_since_traefik_started} "%{DATA:traefik_router_name}" "%{TRAEFIK_SERVER_URL:traefik_server_url}" %{NUMBER:request_duration_in_ms}ms'17 apply_on: message18 nodes:19 ## Parse root, intermediate (if any), and leaf routers from full router chain20 - grok:21 pattern: '^%{TRAEFIK_ROUTER:traefik_router_name_root}(?: -> (?:%{DATA:traefik_router_intermediate} -> )?%{TRAEFIK_ROUTER:traefik_router_leaf})?$'22 expression: evt.Parsed.traefik_router_name23 ## JSON parser - extract fields and store full router chain in traefik_router_name (backwards compatible)24 # We must use evt.Parsed.message to make sure we respect s00 stage25 - filter: TrimSpace(evt.Parsed.message) startsWith "{" && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "traefik") in ["", nil]26 nodes:27 ## Parse root, intermediate (if any), and leaf routers from full router chain28 - grok:29 pattern: '^%{TRAEFIK_ROUTER:traefik_router_name_root}?(?: -> (?:%{DATA:traefik_router_intermediate} -> )?%{TRAEFIK_ROUTER:traefik_router_leaf})?$'30 expression: "evt.Unmarshaled.traefik.RouterName ?? ''"31 statics:32 - parsed: remote_addr33 ## Split by comma and take last IP to handle proxied requests (e.g., ZScaler)34 expression: "TrimSpace(Split(evt.Unmarshaled.traefik.ClientHost, ',')[-1])"35 - parsed: dest_addr36 ## Split dest_addr to get IP only as this is original functionality37 expression: Split(evt.Unmarshaled.traefik.ClientAddr, ':')[0]38 - parsed: request_addr39 expression: evt.Unmarshaled.traefik.RequestAddr40 - parsed: service_addr41 ## Split service_addr to get IP only as this is original functionality42 expression: "evt.Unmarshaled.traefik.ServiceAddr != nil ? Split(evt.Unmarshaled.traefik.ServiceAddr, ':')[0] : nil"43 - parsed: http_user_agent44 expression: evt.Unmarshaled.traefik["request_User-Agent"] ## We have to access via [] as the key contains a dash45 - parsed: body_bytes_sent46 ## We have to check if DownstreamContentSize is nil, as it will cause EXPR error if it is47 expression: "evt.Unmarshaled.traefik.DownstreamContentSize != nil ? int(evt.Unmarshaled.traefik.DownstreamContentSize) : nil"48 - parsed: request_duration_in_ms49 expression: int(evt.Unmarshaled.traefik.Duration)50 - parsed: traefik_router_name51 ## Full router chain (backwards compatible)52 expression: "evt.Unmarshaled.traefik.RouterName ?? ''"53 - parsed: time_local54 expression: evt.Unmarshaled.traefik.time55 - parsed: verb56 expression: evt.Unmarshaled.traefik.RequestMethod57 - parsed: request58 expression: evt.Unmarshaled.traefik.RequestPath59 - parsed: http_version60 ## Split http_version to get version only as this is original functionality61 expression: Split(evt.Unmarshaled.traefik.RequestProtocol, '/')[1]62 - parsed: status63 expression: int(evt.Unmarshaled.traefik.DownstreamStatus)64 - meta: target_fqdn65 expression: "evt.Unmarshaled.traefik.RequestHost != nil ? evt.Unmarshaled.traefik.RequestHost : ''"66statics:67 - meta: service68 value: http69 - meta: http_status70 expression: "evt.Parsed.status"71 - meta: http_path72 expression: "evt.Parsed.request"73 - meta: user74 expression: "evt.Parsed.remote_user"75 - meta: source_ip76 expression: "evt.Parsed.remote_addr"77 - meta: http_user_agent78 expression: "evt.Parsed.http_user_agent"79 - meta: log_type80 value: http_access-log81 - target: evt.StrTime82 expression: "evt.Parsed.time_local"83 - meta: traefik_router_name_root84 expression: "evt.Parsed.traefik_router_leaf != '' ? evt.Parsed.traefik_router_name_root : ''"85 - meta: traefik_router_name_intermediate86 expression: "evt.Parsed.traefik_router_intermediate"87 - meta: traefik_router_name_leaf88 expression: "evt.Parsed.traefik_router_leaf"89 - meta: traefik_router_name90 ## Full router chain (backwards compatible)91 expression: "evt.Parsed.traefik_router_name"92 - meta: http_verb93 expression: "evt.Parsed.verb"94