filenames: - /var/log/nginx/access-*.log - /var/log/nginx/error.loglabels: type: nginx---filenames: - /var/log/auth.loglabels: type: syslog---journalctl_filter: - "_SYSTEMD_UNIT=ssh.service"labels: type: syslog
crowdsec_service section of configuration supports
The default setting is to have
acquisition_path pointing to
acquisition_dir can be set to point to a directory where every
.yaml file is considered as a valid acquisition configuration file.
A string representing the path to a file (globbing supported)
A list of string represent paths to files (globbing supported)
labels object with a field
type indicating the log's type.
labels.type is important as it is what will determine which parser will try to process the logs.
The log won't be processed by the syslog parser if its type is not syslog/
...filter: "evt.Line.Labels.type == 'syslog'"...
On the other hand, nginx tends to write its own logs without using syslog.
...filter: "evt.Parsed.program startsWith 'nginx'"...
If for example your nginx was logging via syslog, you need to set its
syslog so that it's first parsed by the syslog parser, and then by the nginx parser (notice they are in different stages).
A list of string passed as arguments to