Open oyale opened 1 year ago
@oyale: Thanks for opening an issue, it is currently awaiting triage.
In the meantime, you can:
I've realized that the difference was the response time in the log. I've managed to temporally fix it by adding:
RESPONSETIME: '[0-9]+\.[0-9]+'
to the pattern_syntax
and modifying the grok pattern by adding it:
pattern: '(%{IPORHOST:target_fqdn} )?%{IPORHOST:remote_addr} - %{NGCUSTOMUSER:remote_user}? \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} (%{RESPONSETIME:response_time})? "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"( %{NUMBER:request_length} %{NUMBER:request_time} \[%{DATA:proxy_upstream_name}\] \[%{DATA:proxy_alternative_upstream_name}\])?'
(both of them on /etc/crowdsec/parsers/s01-parse/nginx-logs.yaml
).
I wonder what is the proper way to fix the expression because I guess those patches will be overridden in future updates.
Could you help me with that? Should I write a new parser?
Never knew the response time could be a float, I will transfer to the hub which can handle this update.
What happened?
After installing CrowdSec v1.5.2 on Ubuntu 18.04.4 using the provided repository and script, and then installing
crowdsec
andcrowdsec-firewall-bouncer-iptables
, the NGINX logs are not being parsed correctly.What did you expect to happen?
crowdsec
andcrowdsec-firewall-bouncer-iptables
.How can we reproduce it (as minimally and precisely as possible)?
I used the
cscli explain
command with the following log:And received the following error:
Anything else we need to know?
nginx's log_format:
nginx -v
Crowdsec version
OS version
Enabled collections and parsers
Acquisition config
Config show
Prometheus metrics
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.
No response