1onsuccess: next_stage
2#debug: true
3filter: "Upper(evt.Parsed.program) == 'AUDIOBOOKSHELF'"
4name: plague-doctor/audiobookshelf-logs
5description: "Parse Audiobookshelf logs"
6pattern_syntax:
7    ABS_FAILED_AUTH: '\[Auth\] Failed login attempt for username \\?"%{USERNAME:username}\\?" from ip %{IP:source_ip} \(%{DATA:reason}\)'
8nodes:
9    - grok:
10        pattern: '\[%{TIMESTAMP_ISO8601:timestamp}\] ERROR: %{ABS_FAILED_AUTH}'
11        apply_on: message
12      statics:
13        - meta: log_type
14          value: abs_failed_auth
15    - filter: 'UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "abs") in ["", nil]'
16      grok:
17        pattern: "%{ABS_FAILED_AUTH}"
18        expression: evt.Unmarshaled.abs.message
19        statics:
20          - meta: log_type
21            value: abs_failed_auth
22statics:
23    - meta: service
24      value: audiobookshelf
25    - meta: source_ip
26      expression: "evt.Parsed.source_ip"
27    - target: evt.StrTime
28      expression: 'evt.Parsed.timestamp != "" ? evt.Parsed.timestamp : evt.Unmarshaled.abs.timestamp'
29    ## We check if the parser parsed the timestamp or if it within the json output
30    - meta: username
31      expression: "evt.Parsed.username"
32