1filter: evt.Parsed.program == 'keycloak'
2onsuccess: next_stage
3name: inherent-io/keycloak-logs
4description: "Parse keycloak logs"
5pattern_syntax:
6  KEYCLOAK_DATETIME: "[0-9]+-[0-9]+-[0-9]+ [0-2][0-9]:[0-5][0-9]:[0-5][0-9],[0-9]{3}"
7  KEYCLOAK_LOG_LEVEL: "(DEBUG|WARN|ERROR|INFO)"
8  KEYCLOAK_LOG_LINE: '^%{KEYCLOAK_DATETIME:datetime} %{KEYCLOAK_LOG_LEVEL:log_level}\s+\[org.*\]\s+\(executor-thread-\d+\)\s+%{GREEDYDATA:parsed_message}'
9nodes:
10  - grok:
11      name: "KEYCLOAK_LOG_LINE"
12      apply_on: message
13    nodes:
14      - filter: ParseKV(evt.Parsed.parsed_message, evt.Unmarshaled, "keycloak") in ["", nil]
15        statics:
16          - meta: log_type
17            expression: trimSuffix(evt.Unmarshaled.keycloak.type, ",")
18          - meta: error
19            expression: trimSuffix(evt.Unmarshaled.keycloak.error ?? "", ",")
20          - meta: source_ip
21            expression: trimSuffix(evt.Unmarshaled.keycloak.ipAddress, ",")
22          - meta: username
23            expression: trimSuffix(evt.Unmarshaled.keycloak.username, ",")
24statics:
25  - meta: service
26    value: keycloak
27  - target: evt.StrTime
28    expression: evt.Parsed.datetime
29  - meta: log_level
30    expression: evt.Parsed.log_level
31  - target: evt.StrTimeFormat
32    value: "2006-01-02 15:04:05,999999999"
33