A cri-log s00 for syslog events

00-cri-syslogs.yaml

filter: "evt.Line.Labels.type == 'containerd' && evt.Line.Labels.program == 'syslog'"
name: crowdsecurity/cri-syslogs
description: CRI logging format parser for syslogs
#debug: true
pattern_syntax:
  RAW_SYSLOG_PREFIX: '^<%{NUMBER:stuff1}>%{NUMBER:stuff2} %{SYSLOGBASE2} %{DATA:program} %{NUMBER:pid}'
  RAW_SYSLOG_META: '\[meta sequenceId="%{NOTDQUOTE:seq_id}"\]'
nodes:
  - grok:
      pattern: "^%{TIMESTAMP_ISO8601:cri_timestamp} %{WORD:stream} %{WORD:logtag} %{GREEDYDATA:message}"
      apply_on: Line.Raw
    nodes:
      - grok:
          pattern: "^%{SYSLOGLINE}"
          apply_on: message
        onsuccess: next_stage
      - grok:
          pattern: '%{RAW_SYSLOG_PREFIX} - %{RAW_SYSLOG_META} %{GREEDYDATA:message}'
          apply_on: message
        onsuccess: next_stage
statics:
- parsed: "logsource"
  value: "cri"
- target: evt.StrTime
  expression: evt.Parsed.cri_timestamp
- parsed: program
  expression: evt.Parsed.program
- meta: datasource_path
  expression: evt.Line.Src
- meta: datasource_type
  expression: evt.Line.Module