cscli parsers install xs539/bookstack-logsParser for Bookstack logs
You will need to enable Failed Access Logging (off by default)
1LOG_FAILED_LOGIN_MESSAGE="Failed login for %u"
Example acquisition config:
1---2filenames:3 - /var/log/bookstack.log4labels:5 type: bookstack6---
1onsuccess: next_stage2filter: "Lower(evt.Parsed.program) in ['bookstack']"3name: xs539/bookstack-logs4description: "Parse bookstack logs"5pattern_syntax:6 BOOKSTACK_USER: "(%{EMAILADDRESS}|%{USERNAME})"7nodes:8 - grok:9 pattern: '%{NGINXERRTIME:timestamp}%{GREEDYDATA}Failed login for %{BOOKSTACK_USER:target_user}%{GREEDYDATA}client: %{IPORHOST:remote_addr}'10 apply_on: message11 - grok:12 pattern: '\[%{APACHEERRORTIME:timestamp}\] \[php:%{WORD:log_level}\] \[pid %{INT:pid}\] \[client %{IPORHOST:remote_addr}(:%{INT:remote_port})?\] Failed login for %{BOOKSTACK_USER:target_user}(, referer: %{GREEDYDATA:http_referer})?'13 apply_on: message14statics:15 - meta: log_type16 value: bookstack_failed_auth17 - meta: target_user18 expression: evt.Parsed.target_user19 - meta: service20 value: bookstack21 - target: evt.StrTime22 expression: evt.Parsed.timestamp23 - meta: source_ip24 expression: evt.Parsed.remote_addr25