bookstack-logs Log Parser by xs539 | CrowdSec Hub

bookstack-logs

Log parser

By: xs539
Version: 0.2

Parse bookstack logs

Install with a top-level collection

1 collection include it

sudo cscli collections install xs539/bookstack

Installs 1 parser and 1 scenario.

View bookstack →

Installation

sudo cscli parsers install xs539/bookstack-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/xs539/bookstack-logs.yaml· 24 linesGitHub

1onsuccess: next_stage1
2filter: "Lower(evt.Parsed.program) in ['bookstack']"2
3name: xs539/bookstack-logs
4description: "Parse bookstack logs"
5pattern_syntax:3
6  BOOKSTACK_USER: "(%{EMAILADDRESS}|%{USERNAME})"
7nodes:4
8  - grok:5
9      pattern: '%{NGINXERRTIME:timestamp}%{GREEDYDATA}Failed login for %{BOOKSTACK_USER:target_user}%{GREEDYDATA}client: %{IPORHOST:remote_addr}'
10      apply_on: message
11  - grok:
12      pattern: '\[%{APACHEERRORTIME:timestamp}\] \[php:%{WORD:log_level}\] \[pid %{INT:pid}\] \[client %{IPORHOST:remote_addr}(:%{INT:remote_port})?\] Failed login for %{BOOKSTACK_USER:target_user}(, referer: %{GREEDYDATA:http_referer})?'
13      apply_on: message
14statics:6
15    - meta: log_type
16      value: bookstack_failed_auth
17    - meta: target_user
18      expression: evt.Parsed.target_user
19    - meta: service
20      value: bookstack
21    - target: evt.StrTime
22      expression: evt.Parsed.timestamp
23    - meta: source_ip
24      expression: evt.Parsed.remote_addr

Installed on

Know where it runs

Documentation

Parser for Bookstack logs

You will need to enable Failed Access Logging (off by default)

1LOG_FAILED_LOGIN_MESSAGE="Failed login for %u"

Example acquisition config:

1---
2filenames:
3 - /var/log/bookstack.log
4labels:
5  type: bookstack
6---