ソースを参照

update docker file to reflect change on acquisitions (#834)

* update docker file to reflect change on acquisitions

* generic --dsn approach

Co-authored-by: he2ss <he2ss>
Thibault "bui" Koechlin 4 年 前
コミット
42bc31cf23
2 ファイル変更4 行追加7 行削除
  1. 1 2
      docker/README.md
  2. 3 5
      docker/docker_start.sh

+ 1 - 2
docker/README.md

@@ -75,8 +75,7 @@ If you want to be able to restart/stop your container and keep the same DB `-v /
 * `PARSERS`                 - Parsers to install from the [hub](https://hub.crowdsec.net/browse/#configurations), separated by space : `-e PARSERS="crowdsecurity/http-logs crowdsecurity/modsecurity"`
 * `POSTOVERFLOWS`           - Postoverflows to install from the [hub](https://hub.crowdsec.net/browse/#configurations), separated by space : `-e POSTOVERFLOWS="crowdsecurity/cdn-whitelist"`
 * `CONFIG_FILE`             - Configuration file (default: `/etc/crowdsec/config.yaml`) : `-e CONFIG_FILE="<config_path>"`
-* `FILE_PATH`               - Process a single file in time-machine : `-e FILE_PATH="<file_path>"`
-* `JOURNALCTL_FILTER`       - Process a single journalctl output in time-machine : `-e JOURNALCTL_FILTER="<journalctl_filter>"`
+* `DSN`                     - Process a single source in time-machine : `-e DSN="file:///var/log/toto.log"` or `-e DSN="cloudwatch:///your/group/path:stream_name?profile=dev&backlog=16h"` or `-e DSN="journalctl://filters=_SYSTEMD_UNIT=ssh.service"`
 * `TYPE`                    - [`Labels.type`](https://docs.crowdsec.net/Crowdsec/v1/references/acquisition/) for file in time-machine : `-e TYPE="<type>"`
 * `TEST_MODE`               - Only test configs (default: `false`) : `-e TEST_MODE="<true|false>"`
 * `TZ`                      - Set the [timezone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) to ensure logs have a local timestamp.

+ 3 - 5
docker/docker_start.sh

@@ -45,12 +45,10 @@ ARGS=""
 if [ "$CONFIG_FILE" != "" ]; then
     ARGS="-c $CONFIG_FILE"
 fi
-if [ "$FILE_PATH" != "" ]; then
-    ARGS="$ARGS -file $FILE"
-fi
-if [ "$JOURNALCTL_FILTER" != "" ]; then
-    ARGS="$ARGS -jfilter $JOURNALCTL_FILTER"
+if [ "$DSN" != "" ]; then
+    ARGS="$ARGS -dsn ${DSN}"
 fi
+
 if [ "$TYPE" != "" ]; then
     ARGS="$ARGS -type $TYPE"
 fi