Giter Club home page Giter Club logo

Comments (2)

AlteredCoder avatar AlteredCoder commented on August 17, 2024

Hello @ririsoft ,

If i understand correctly the issue, you would prefer to groupby ip:port instead of only ip ?

Cheers.

from hub.

ririsoft avatar ririsoft commented on August 17, 2024

Hello @AlteredCoder ,

Grouping by ip is totally fine. I would prefer a grouping by "evt.Meta.source_ip + '/' + %HOST%.
But looking further into this I believe the issue is on my side, sorry.
Indeed I have a custom apache log parsing:

#/etc/crowdsec/config/parsers/s01-parse/apache2-logs.yaml
#Apache access logs
#debug: true
filter: "evt.Parsed.program startsWith 'apache2'"
onsuccess: next_stage
name: crowdsecurity/apache2-logs
description: "Parse Apache2 access and error logs"
#log line can be prefixed by a target_fqdn
grok:
  #pattern: '(%{IPORHOST:target_fqdn} )?%{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}'
  pattern: '(%{URIHOST:target_fqdn} )?%{COMMONAPACHELOG} %{POSINT} %{POSINT} %{QS:referrer} %{QS:agent}'
  apply_on: message
# these ones apply for both grok patterns
statics:
  - meta: log_type
    value: http_access-log
  - target: evt.StrTime
    expression: evt.Parsed.timestamp
  - meta: service
    value: http
  - meta: source_ip
    expression: evt.Parsed.clientip
  - meta: http_status
    expression: evt.Parsed.response
  - meta: http_path
    expression: evt.Parsed.request

I needed to have this to catch the port part with the IP, which is not caugh by the partern %{IPORHOST:target_fqdn} used by crowdsec by default. However my pattern aggregate the IP and PORT together in the target fqdn which is a mistake. I am going to replace it with something else like %{IPORHOST:target_fqdn}(?::%{POSINT:port})?.

I am closing this, since this is due to my personal settings. I am really sorry for the false issue :(

from hub.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.