cscli parsers install xs539/joplin-server-logsParser for Joplin server logs
Example acquisition config:
1---2filenames:3 - /var/log/joplin-server.log4labels:5 type: joplin-server6---
1onsuccess: next_stage2filter: "Lower(evt.Parsed.program) in ['joplin-server']"3name: xs539/joplin-server-logs4description: "Parse Joplin Server logs"5pattern_syntax:6 JOPLIN_DATE: "%{YEAR}[/-]%{MONTHNUM2}[/-]%{DAY2} %{HOUR}:%{MINUTE}:%{SECOND}"7nodes:8 - grok:9 pattern: '%{JOPLIN_DATE:timestamp}%{GREEDYDATA}/api/sessions: %{IPORHOST:remote_addr}%{GREEDYDATA}Invalid username or password%{GREEDYDATA}"%{EMAILADDRESS:target_user}"'10 apply_on: message11 statics:12 - meta: log_type13 value: joplin_server_failed_auth14 - meta: target_user15 expression: evt.Parsed.target_user16 - grok:17 pattern: '%{JOPLIN_DATE:timestamp}: App: %{IPORHOST:remote_addr}: %{NUMBER:body_bytes_sent} B: %{WORD:http_method} %{URIPATH:http_path} \(%{NUMBER:http_status}\) \(%{NUMBER:response_time}ms\)'18 apply_on: message19 statics:20 - meta: log_type21 expression: 'evt.Parsed.http_status == "403" and evt.Parsed.http_path == "/login" ? "joplin_server_failed_auth" : ""'22statics:23 - meta: service24 value: joplin25 - target: evt.StrTime26 expression: evt.Parsed.timestamp27 - meta: source_ip28 expression: evt.Parsed.remote_addr