cscli parsers install schiz0phr3ne/prowlarr-logsParser for Prowlarr Logs.
1---2source: file3filenames:4 - /var/log/syslog5labels:6 type: syslog7---8source: file9filenames:10 - /var/log/prowlarr.txt11labels:12 type: Prowlarr
1onsuccess: next_stage2filter: "evt.Parsed.program == 'Prowlarr'"3name: schiz0phr3ne/prowlarr-logs4description: "Parse Prowlarr Logs"5pattern_syntax:6 DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"7nodes:8 - grok:9 pattern: '^\[Warn\] Auth: Auth-Failure ip %{IP:source_ip} username %{DATA:username}$'10 apply_on: message11 - grok:12 pattern: "%{DATE_YMD:date} %{TIME:time}\\|%{WORD:log_level}\\|Auth\\|Auth-Failure ip %{IPORHOST:source_ip} username '%{NOTDQUOTE:username}'"13 apply_on: message14 statics:15 - target: evt.Parsed.timestamp16 expression: "evt.Parsed.date + ' ' + evt.Parsed.time"17 onsuccess: next_stage18statics:19 - meta: log_type20 value: prowlarr_failed_authentication21 - meta: service22 value: prowlarr23 - meta: source_ip24 expression: "evt.Parsed.source_ip"25 - target: evt.StrTime26 expression: "evt.Parsed.timestamp"27 - meta: username28 expression: evt.Parsed.username29