Doc improvments : remove deprecated prog_name (#105)

* remove deprecated prog_name

* in config as well
This commit is contained in:
Thibault "bui" Koechlin 2020-06-30 10:35:19 +02:00 committed by GitHub
parent e4993996a5
commit cb9eda429e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 6 deletions

View file

@ -8,7 +8,6 @@ labels:
filenames:
- /var/log/auth.log
- /var/log/syslog
#no need to set the prog_name, syslog format contains this info
labels:
type: syslog
---

View file

@ -41,7 +41,7 @@ filenames: #a list of file or regexp to read from (supports regular expressions)
- /var/log/nginx/https_access.log
- /var/log/nginx/error.log
labels:
prog_name: nginx
type: nginx
---
filenames:
- /var/log/auth.log
@ -49,7 +49,7 @@ labels:
type: syslog
```
The `labels` part is here to tag the incoming logs with a type. `labels.prog_name` and `labels.type` are used by the parsers to know which logs to process.
The `labels` part is here to tag the incoming logs with a type. `labels.type` are used by the parsers to know which logs to process.
### **Parser**

View file

@ -6,14 +6,14 @@ There is two option:
- Your logs are wrote from a syslog server, so you just have to install the [syslog parser](https://master.d3padiiorjhf1k.amplifyapp.com/author/crowdsecurity/configurations/syslog-logs)
- You're log are read from a log file. Please add this kind of configuration in your `acquis.yaml` file:
ⓘ the `prog_name` is the one that the parser in `s01-parse` filter will need to match.
ⓘ the `type` is the one that the parser in `s01-parse` filter will need to match.
```
---
filename: <PATH_TO_YOUR_LOG_FILE>
labels:
prog_name: <PROGRAM_NAME>
type: <PROGRAM_NAME>
```
Here an example:
@ -25,7 +25,7 @@ Here an example:
---
filename: /var/log/nginx/access.log
labels:
prog_name: nginx
type: nginx
```
</details>