cscli parsers install schiz0phr3ne/radarr-logsParser for Radarr Logs.
1---2source: file3filenames:4 - /var/log/syslog5labels:6 type: syslog7---8source: file9filenames:10 - /var/log/radarr.txt11labels:12 type: Radarr
1onsuccess: next_stage2filter: "evt.Parsed.program == 'Radarr'"3name: schiz0phr3ne/radarr-logs4description: "Parse Radarr Logs"5pattern_syntax:6 DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"7nodes:8 - grok:9 pattern: '^\[Warn\] Auth: Auth-Failure ip %{IP:source_ip} username %{DATA:username}$'10 apply_on: message11 onsuccess: next_stage12 - grok:13 pattern: "%{DATE_YMD:date} %{TIME:time}\\|%{WORD:log_level}\\|Auth\\|Auth-Failure ip %{IPORHOST:source_ip} username '%{NOTDQUOTE:username}'"14 apply_on: message15 statics:16 - target: evt.Parsed.timestamp17 expression: "evt.Parsed.date + ' ' + evt.Parsed.time"18 onsuccess: next_stage1920statics:21 - meta: service22 value: radarr23 - meta: source_ip24 expression: "evt.Parsed.source_ip"25 - target: evt.StrTime26 expression: "evt.Parsed.timestamp"27 - meta: username28 expression: evt.Parsed.username29 - meta: log_type30 value: radarr_failed_authentication31