1name: lourys/pterodactyl-wings-logs
2description: "Parse Pterodactyl wings logs"
3pattern_syntax:
4  PTERO_TIME: "\\b[A-Z][a-z]{2}.*\\d{1,2} \\d{2}:\\d{2}:\\d{2}\\b"
5filter: "evt.Parsed.program == 'pterodactyl'"
6debug: false
7onsuccess: next_stage
8nodes:
9  - grok:
10      pattern: '^\s*WARN: \[%{PTERO_TIME:time}.*?\] failed to validate user credentials \(invalid format\) ip=%{IPORHOST:source_ip}:%{NUMBER:source_port}.* username=%{USERNAME:username}$'
11      apply_on: message
12      statics:
13        - meta: log_type
14          value: pterodactly_wings_invalid_format
15  - grok:
16      pattern: '^\s*WARN: \[%{PTERO_TIME:time}.*?\] failed to validate user credentials \(invalid username or password\) ip=%{IPORHOST:source_ip}:%{NUMBER:source_port}.* username=%{USERNAME:username}$'
17      apply_on: message
18      statics:
19        - meta: log_type
20          value: pterodactly_wings_invalid_username_or_password
21statics:
22    - meta: service
23      value: pterodactyl
24    - meta: source_ip
25      expression: evt.Parsed.source_ip
26    - meta: target_user
27      expression: evt.Parsed.username
28    - target: evt.StrTime
29      expression: evt.Parsed.time
30