cscli parsers install schiz0phr3ne/sonarr-logsParser for Sonarr Logs.
1---2source: file3filenames:4 - /var/log/syslog5labels:6 type: syslog7---8source: file9filenames:10 - /var/log/sonarr.txt11labels:12 type: Sonarr
1onsuccess: next_stage2filter: "evt.Parsed.program in ['mono', 'Sonarr']"3name: schiz0phr3ne/sonarr-logs4description: "Parse Sonarr Logs"5pattern_syntax:6 DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"7nodes:8 - grok:9 pattern: '^\[Warn\] Auth: Auth-Failure ip %{IP:source_ip} username %{DATA:username}$'10 apply_on: message11 - grok:12 pattern: "%{DATE_YMD:date} %{TIME:time}\\|%{WORD:log_level}\\|Auth\\|Auth-Failure ip %{IPORHOST:source_ip} username '%{NOTDQUOTE:username}'"13 apply_on: message14 statics:15 - target: evt.Parsed.timestamp16 expression: "evt.Parsed.date + ' ' + evt.Parsed.time"17 onsuccess: next_stage1819statics:20 - meta: log_type21 value: sonarr_failed_authentication22 - meta: service23 value: sonarr24 - meta: source_ip25 expression: "evt.Parsed.source_ip"26 - target: evt.StrTime27 expression: "evt.Parsed.timestamp"28 - meta: username29 expression: evt.Parsed.username30