cscli parsers install firix/authentik-logsParser for Authentik Logs.
1---2filenames:3 - /var/log/authentik.log4labels:5 type: authentik
1---2source: docker3container_name:4 - authentik5labels:6 type: authentik
1name: firix/authentik-logs2description: "Parse Authentik logs"3filter: "Lower(evt.Parsed.program) in ['authentik', 'authentik-server']"4onsuccess: next_stage5nodes:6 - filter: "JsonExtract(evt.Parsed.message, 'action') == 'login_failed'"7 statics:8 - meta: log_type9 value: authentik_failed_auth10 - meta: username11 expression: JsonExtract(evt.Parsed.message, "context.username")12 - filter: "JsonExtract(evt.Parsed.message, 'action') == 'invalid_identifier'"13 statics:14 - meta: log_type15 value: authentik_invalid_username16 - meta: username17 expression: JsonExtract(evt.Parsed.message, "identifier")18statics:19 - meta: service20 value: authentik21 - meta: source_ip22 expression: JsonExtract(evt.Parsed.message, "client_ip")23 - target: evt.StrTime24 expression: JsonExtract(evt.Parsed.message, "timestamp") + "Z"25