VictoriaLogs

This module allows the Security Engine to acquire logs from VictoriaLogs query.

Configuration example

This will allow to read logs from VictoriaLogs, using the query app:nginx.

YAML

source: victorialogs
mode: tail
log_level: info
url: http://localhost:9428/
limit: 1000
query: |
  app:nginx
auth:
  username: something
  password: secret
labels:
 type: nginx

info

The reader will always start at "now" for tail mode.

See Parameters for all supported options.

Parameters

mode

Mode to fetch the logs, supported values: tail and cat.

Defaults to tail.

url

The VictoriaLogs URL to connect to.

Required.

prefix

The VictoriaLogs prefix (present in http path, useful if VictoriaLogs is behind a reverse-proxy).

Defaults to /.

query

The VictoriaLogs query.

Required.

Note that tail requests limit which operators can be used in the query. See this doc for the details.

limit

The maximum number of messages to retrieve from VictoriaLogs at once.

headers

Allows you to specify headers to be sent to VictoriaLogs, in the format:

YAML

headers:
  foo: bar
  AccountID: 0
  ProjectID: 0

See this doc for more information: VictoriaLogs headers

wait_for_ready

How long to wait at startup for VictoriaLogs to be ready before giving up.

Defaults to 10 seconds.

auth

Login/password authentication for VictoriaLogs, in the format:

YAML

auth:
  username: someone
  password: something

max_failure_duration

The maximum duration VictoriaLogs is allowed to be unavailable (once startup is successful) before giving up on the data source.

Defaults to 30 seconds.

DSN and command-line

All the parameters above are available via DSN (one-shot mode), plus the following ones:

ssl

if present, scheme will be set to https

since

Allows to set the "start" duration for VictoriaLogs query.

log_level

Set the log_level for VictoriaLogs datasource.

SH

crowdsec -type foobar -dsn 'victorialogs://login:password@localhost:9428/?query=server:"demoVictoriaLogsVictoriaLogs"'