Doc improvments : remove deprecated prog_name (#105)
* remove deprecated prog_name * in config as well
This commit is contained in:
parent
e4993996a5
commit
cb9eda429e
3 changed files with 5 additions and 6 deletions
|
@ -8,7 +8,6 @@ labels:
|
|||
filenames:
|
||||
- /var/log/auth.log
|
||||
- /var/log/syslog
|
||||
#no need to set the prog_name, syslog format contains this info
|
||||
labels:
|
||||
type: syslog
|
||||
---
|
||||
|
|
|
@ -41,7 +41,7 @@ filenames: #a list of file or regexp to read from (supports regular expressions)
|
|||
- /var/log/nginx/https_access.log
|
||||
- /var/log/nginx/error.log
|
||||
labels:
|
||||
prog_name: nginx
|
||||
type: nginx
|
||||
---
|
||||
filenames:
|
||||
- /var/log/auth.log
|
||||
|
@ -49,7 +49,7 @@ labels:
|
|||
type: syslog
|
||||
```
|
||||
|
||||
The `labels` part is here to tag the incoming logs with a type. `labels.prog_name` and `labels.type` are used by the parsers to know which logs to process.
|
||||
The `labels` part is here to tag the incoming logs with a type. `labels.type` are used by the parsers to know which logs to process.
|
||||
|
||||
### **Parser**
|
||||
|
||||
|
|
|
@ -6,14 +6,14 @@ There is two option:
|
|||
- Your logs are wrote from a syslog server, so you just have to install the [syslog parser](https://master.d3padiiorjhf1k.amplifyapp.com/author/crowdsecurity/configurations/syslog-logs)
|
||||
- You're log are read from a log file. Please add this kind of configuration in your `acquis.yaml` file:
|
||||
|
||||
ⓘ the `prog_name` is the one that the parser in `s01-parse` filter will need to match.
|
||||
ⓘ the `type` is the one that the parser in `s01-parse` filter will need to match.
|
||||
|
||||
|
||||
```
|
||||
---
|
||||
filename: <PATH_TO_YOUR_LOG_FILE>
|
||||
labels:
|
||||
prog_name: <PROGRAM_NAME>
|
||||
type: <PROGRAM_NAME>
|
||||
|
||||
```
|
||||
Here an example:
|
||||
|
@ -25,7 +25,7 @@ Here an example:
|
|||
---
|
||||
filename: /var/log/nginx/access.log
|
||||
labels:
|
||||
prog_name: nginx
|
||||
type: nginx
|
||||
```
|
||||
|
||||
</details>
|
||||
|
|
Loading…
Add table
Reference in a new issue