1onsuccess: next_stage
2filter: "evt.Parsed.program in ['mono', 'Sonarr']"
3name: schiz0phr3ne/sonarr-logs
4description: "Parse Sonarr Logs"
5pattern_syntax:
6  DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"
7nodes:
8  - grok:
9      pattern: '^\[Warn\] Auth: Auth-Failure ip %{IP:source_ip} username %{DATA:username}$'
10      apply_on: message
11  - grok:
12      pattern: "%{DATE_YMD:date} %{TIME:time}\\|%{WORD:log_level}\\|Auth\\|Auth-Failure ip %{IPORHOST:source_ip} username '%{NOTDQUOTE:username}'"
13      apply_on: message
14      statics:
15        - target: evt.Parsed.timestamp
16          expression: "evt.Parsed.date + ' ' + evt.Parsed.time"
17    onsuccess: next_stage
18
19statics:
20    - meta: log_type
21      value: sonarr_failed_authentication
22    - meta: service
23      value: sonarr
24    - meta: source_ip
25      expression: "evt.Parsed.source_ip"
26    - target: evt.StrTime
27      expression: "evt.Parsed.timestamp"
28    - meta: username
29      expression: evt.Parsed.username
30