Skip to content

Instantly share code, notes, and snippets.

@narate

narate/parsers.conf

Last active October 7, 2021 03:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save narate/267c6981f13e75b5d7116fd09554a889 to your computer and use it in GitHub Desktop.
Save narate/267c6981f13e75b5d7116fd09554a889 to your computer and use it in GitHub Desktop.
Download ZIP
Fluent-bit auth log parser (/var/log/auth.log) https://rubular.com/r/kR7esS0duCgtoR
Raw
parsers.conf
[PARSER]
Name auth
Format regex
Regex ^(?<time>[^ ].* \d+ \d{2}:\d{2}:\d{2}) (?<host>[\S]*) (?<program>[^\[\] ]*)(\[(?<pid>\d*)\])?: (?<message>.*)$
Time_Key time
Time_Format %b %d %H:%M:%S
Time_Keep Off
# Time_Offset +0700
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment