cscli parsers install gauth-fr/immich-logsParser for Immich Logs.
1---2filenames:3 - /var/log/immich_server.log4labels:5 type: immich
1---2source: docker3container_name:4 - immich_server5#container_id:6# - 843ee92d231b7labels:8 type: immich
1onsuccess: next_stage2#debug: false3name: gauth-fr/immich-logs4description: "Parse Immich logs"5filter: "evt.Parsed.program == 'immich'"6pattern_syntax:7 IMMICH_CUSTOMDATE_PM: "%{MONTHNUM2}/%{MONTHDAY}/%{YEAR}, %{TIME} (AM|PM|am|pm)"8 IMMICH_CUSTOMDATE: "%{MONTHNUM2}/%{MONTHDAY}/%{YEAR}, %{TIME}"9nodes:10 - grok:11 pattern: ".*%{IMMICH_CUSTOMDATE_PM:timestamp}.*Failed login attempt for user %{EMAILADDRESS:username} from ip address %{IP:source_ip}.*"12 #[Nest] 7 - 08/02/2023, 7:34:03 PM WARN [AuthService] Failed login attempt for user fds@hdd.com from ip address 176.172.44.2111314 apply_on: message15 statics:16 - meta: log_type17 value: immich_failed_auth18 - target: evt.StrTimeFormat19 value: "01/02/2006, 3:04:05 PM"20 - grok:21 pattern: ".*%{IMMICH_CUSTOMDATE:timestamp}.*Failed login attempt for user %{EMAILADDRESS:username} from ip address %{IP:source_ip}.*"22 #[Nest] 7 - 08/02/2023, 7:34:03 WARN [AuthService] Failed login attempt for user fds@hdd.com from ip address 176.172.44.2112324 apply_on: message25 statics:26 - meta: log_type27 value: immich_failed_auth28 - target: evt.StrTimeFormat29 value: "01/02/2006, 15:04:05"3031statics:32 - meta: service33 value: immich34 - meta: user35 expression: "evt.Parsed.username"36 - meta: source_ip37 expression: "evt.Parsed.source_ip"38 - target: evt.StrTime39 expression: evt.Parsed.timestamp40