|
@@ -6,14 +6,14 @@ There is two option:
|
|
- Your logs are wrote from a syslog server, so you just have to install the [syslog parser](https://master.d3padiiorjhf1k.amplifyapp.com/author/crowdsecurity/configurations/syslog-logs)
|
|
- Your logs are wrote from a syslog server, so you just have to install the [syslog parser](https://master.d3padiiorjhf1k.amplifyapp.com/author/crowdsecurity/configurations/syslog-logs)
|
|
- You're log are read from a log file. Please add this kind of configuration in your `acquis.yaml` file:
|
|
- You're log are read from a log file. Please add this kind of configuration in your `acquis.yaml` file:
|
|
|
|
|
|
-ⓘ the `prog_name` is the one that the parser in `s01-parse` filter will need to match.
|
|
|
|
|
|
+ⓘ the `type` is the one that the parser in `s01-parse` filter will need to match.
|
|
|
|
|
|
|
|
|
|
```
|
|
```
|
|
---
|
|
---
|
|
filename: <PATH_TO_YOUR_LOG_FILE>
|
|
filename: <PATH_TO_YOUR_LOG_FILE>
|
|
labels:
|
|
labels:
|
|
- prog_name: <PROGRAM_NAME>
|
|
|
|
|
|
+ type: <PROGRAM_NAME>
|
|
|
|
|
|
```
|
|
```
|
|
Here an example:
|
|
Here an example:
|
|
@@ -25,7 +25,7 @@ Here an example:
|
|
---
|
|
---
|
|
filename: /var/log/nginx/access.log
|
|
filename: /var/log/nginx/access.log
|
|
labels:
|
|
labels:
|
|
- prog_name: nginx
|
|
|
|
|
|
+ type: nginx
|
|
```
|
|
```
|
|
|
|
|
|
</details>
|
|
</details>
|