Doc improvments : remove deprecated prog_name (#105)
* remove deprecated prog_name * in config as well
This commit is contained in:
parent
e4993996a5
commit
cb9eda429e
|
@ -8,7 +8,6 @@ labels:
|
||||||
filenames:
|
filenames:
|
||||||
- /var/log/auth.log
|
- /var/log/auth.log
|
||||||
- /var/log/syslog
|
- /var/log/syslog
|
||||||
#no need to set the prog_name, syslog format contains this info
|
|
||||||
labels:
|
labels:
|
||||||
type: syslog
|
type: syslog
|
||||||
---
|
---
|
||||||
|
|
|
@ -41,7 +41,7 @@ filenames: #a list of file or regexp to read from (supports regular expressions)
|
||||||
- /var/log/nginx/https_access.log
|
- /var/log/nginx/https_access.log
|
||||||
- /var/log/nginx/error.log
|
- /var/log/nginx/error.log
|
||||||
labels:
|
labels:
|
||||||
prog_name: nginx
|
type: nginx
|
||||||
---
|
---
|
||||||
filenames:
|
filenames:
|
||||||
- /var/log/auth.log
|
- /var/log/auth.log
|
||||||
|
@ -49,7 +49,7 @@ labels:
|
||||||
type: syslog
|
type: syslog
|
||||||
```
|
```
|
||||||
|
|
||||||
The `labels` part is here to tag the incoming logs with a type. `labels.prog_name` and `labels.type` are used by the parsers to know which logs to process.
|
The `labels` part is here to tag the incoming logs with a type. `labels.type` are used by the parsers to know which logs to process.
|
||||||
|
|
||||||
### **Parser**
|
### **Parser**
|
||||||
|
|
||||||
|
|
|
@ -6,14 +6,14 @@ There is two option:
|
||||||
- Your logs are wrote from a syslog server, so you just have to install the [syslog parser](https://master.d3padiiorjhf1k.amplifyapp.com/author/crowdsecurity/configurations/syslog-logs)
|
- Your logs are wrote from a syslog server, so you just have to install the [syslog parser](https://master.d3padiiorjhf1k.amplifyapp.com/author/crowdsecurity/configurations/syslog-logs)
|
||||||
- You're log are read from a log file. Please add this kind of configuration in your `acquis.yaml` file:
|
- You're log are read from a log file. Please add this kind of configuration in your `acquis.yaml` file:
|
||||||
|
|
||||||
ⓘ the `prog_name` is the one that the parser in `s01-parse` filter will need to match.
|
ⓘ the `type` is the one that the parser in `s01-parse` filter will need to match.
|
||||||
|
|
||||||
|
|
||||||
```
|
```
|
||||||
---
|
---
|
||||||
filename: <PATH_TO_YOUR_LOG_FILE>
|
filename: <PATH_TO_YOUR_LOG_FILE>
|
||||||
labels:
|
labels:
|
||||||
prog_name: <PROGRAM_NAME>
|
type: <PROGRAM_NAME>
|
||||||
|
|
||||||
```
|
```
|
||||||
Here an example:
|
Here an example:
|
||||||
|
@ -25,7 +25,7 @@ Here an example:
|
||||||
---
|
---
|
||||||
filename: /var/log/nginx/access.log
|
filename: /var/log/nginx/access.log
|
||||||
labels:
|
labels:
|
||||||
prog_name: nginx
|
type: nginx
|
||||||
```
|
```
|
||||||
|
|
||||||
</details>
|
</details>
|
||||||
|
|
Loading…
Reference in a new issue