cscli parsers install hitech95/nginx-mail-logsA generic parser for ngx_mail_core module:
ngx_mail_auth_http_module1filenames:2 - /var/log/nginx/*.log3labels:4 type: nginx
1filter: "evt.Parsed.program startsWith 'nginx'"2onsuccess: next_stage3name: hitech95/nginx-mail-logs4description: "Parse Nginx Mail logs"5pattern_syntax:6 NO_DOUBLE_QUOTE: '[^"]+'7nodes:8 - grok:9 pattern: '%{NGINXERRTIME:time} \[%{LOGLEVEL:loglevel}\] %{NONNEGINT:pid}#%{NONNEGINT:tid}: (\*%{NONNEGINT:cid} )?client %{IPORHOST:remote_addr}:%{POSINT:remote_port} connected to %{IPORHOST:dest_ip}:%{POSINT:dest_port}'10 apply_on: message11 statics:12 - meta: log_type13 value: "mail_new_session"14 - target: evt.StrTime15 expression: evt.Parsed.time16 - grok:17 pattern: '%{NGINXERRTIME:time} \[%{LOGLEVEL:loglevel}\] %{NONNEGINT:pid}#%{NONNEGINT:tid}: (\*%{NONNEGINT:cid} )?%{GREEDYDATA:message}, client: %{IPORHOST:remote_addr}( using starttls,|,) server: %{IPORHOST:dest_ip}:%{POSINT:dest_port}(, login: "%{NO_DOUBLE_QUOTE:username}")?(, upstream: %{IPORHOST:proxy_ip}:%{POSINT:proxy_port})?'18 apply_on: message19 filter: "evt.Parsed.message contains 'client '"20 statics:21 - target: evt.StrTime22 expression: evt.Parsed.time23 - meta: username24 expression: evt.Parsed.username25 - meta: log_type26 value: "mail_auth"27 nodes:28 - filter: "evt.Parsed.message contains 'logged in'"29 statics:30 - meta: sub_type31 value: "auth_success"32 - filter: "evt.Parsed.message contains 'login failed'"33 pattern_syntax:34 MAIL_HTTP_AUTH: 'client login failed: "%{NO_DOUBLE_QUOTE:auth_result}" while'35 grok:36 pattern: '%{MAIL_HTTP_AUTH}'37 apply_on: message38 statics:39 - meta: sub_type40 value: "auth_fail"41 - meta: auth_result42 expression: evt.Parsed.auth_result43# these ones apply for both grok patterns44statics:45 - meta: service46 value: mail47 - meta: source_ip48 expression: "evt.Parsed.remote_addr"49 - meta: dest_ip50 expression: "evt.Parsed.dest_ip"51 - meta: dest_port52 expression: "evt.Parsed.dest_port"53