cscli parsers install jbowdre/miniflux-logsParser for Miniflux Logs.
Set LOG_DATE_TIME=1 so Miniflux will timestamp the logs.
1---2source: docker3container_name:4 - miniflux5labels:6 type: miniflux
1onsuccess: next_stage2#debug: false3name: jbowdre/miniflux-logs4description: "Parse Miniflux logs"5filter: "evt.Parsed.program == 'miniflux'"67nodes:8 - grok:9 pattern: '.*time=%{DATA:timestamp} .*authentication_failed=true client_ip=%{IP:source_ip} .*username=%{USERNAME:username} .*error="store: invalid password for \\"%{USERNAME}\\".*"'10 # miniflux | time=2024-01-12T22:55:30.265Z level=WARN msg="Incorrect username or password" authentication_failed=true client_ip=192.168.0.254 user_agent="Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" username=user1 error="store: invalid password for \"user1\" (crypto/bcrypt: hashedPassword is not the hash of the given password)"11 apply_on: message12 statics:13 - meta: log_type14 value: miniflux_failed_auth15 - meta: log_subtype16 value: miniflux_bad_password17 - meta: evt.StrTimeFormat18 value: "2006-01-02T15:04:05.999Z"19 - grok:20 pattern: '.*time=%{DATA:timestamp} .*authentication_failed=true client_ip=%{IP:source_ip} .*username=%{USERNAME:username} .*error="store: unable to find this user: %{USERNAME}"'21 # miniflux | time=2024-01-12T22:54:56.307Z level=WARN msg="Incorrect username or password" authentication_failed=true client_ip=192.168.0.254 user_agent="Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" username=hacker1 error="store: unable to find this user: hacker1"22 apply_on: message23 statics:24 - meta: log_type25 value: miniflux_failed_auth26 - meta: log_subtype27 value: miniflux_bad_user28 - meta: evt.StrTimeFormat29 value: "2006-01-02T15:04:05.999Z"3031statics:32 - meta: service33 value: miniflux34 - meta: user35 expression: evt.Parsed.username36 - meta: source_ip37 expression: evt.Parsed.source_ip38 - target: evt.StrTime39 expression: evt.Parsed.timestamp4041