1# cyrille37/sympa_ww-logs
2# Version: 2025-11-09
3#
4# @see sympa_ww-logs.md
5#
6# Docs:
7# - [Parser creation : skeleton](https://docs.crowdsec.net/docs/next/log_processor/parsers/create/#parser-creation--skeleton)
8# - [expression language](https://expr-lang.org/docs/language-definition)
9#
10name: cyrille37/sympa_ww-logs
11description: "Parse wwsympa syslog lines"
12#debug: true
13filter: evt.Parsed.program == 'wwsympa'
14onsuccess: next_stage
15
16nodes:
17  - grok:
18      pattern: '%{WORD:sympa_loglevel} %{GREEDYDATA:sympa_where_action} (?:\[robot %{DATA:sympa_robot}\]) (?:\[session %{DATA:sympa_session}\]) (?:\[client %{IPORHOST:sympa_client_ip}\])(?: \[user %{DATA:sympa_user}\])?( %{GREEDYDATA:sympa_message})?'
19      apply_on: message
20    nodes:
21      - filter: "evt.Parsed.sympa_message contains 'Unknown action'"
22        statics:
23          - meta: sympa_warn
24            value: unknow-action
25      - filter: "evt.Parsed.sympa_message contains 'Unknown list'"
26        statics:
27          - meta: sympa_warn
28            value: unknow-list
29
30statics:
31  - meta: service
32    value: wwsympa
33  - meta: source_ip
34    expression: "evt.Parsed.sympa_client_ip"
35  - meta: sympa_where_action
36    expression: "evt.Parsed.sympa_where_action"
37  - meta: sympa_robot
38    expression: "evt.Parsed.sympa_robot"
39  - meta: sympa_warn
40    expression: "evt.Meta.sympa_warn"
41  - meta: sympa_message
42    expression: "evt.Parsed.sympa_message"
43
44