crowdsecurity/hub

LaPresidente jellyseerr collection is not parsing logs

cellulosa opened this issue · 2 comments

Hi there, I installed @LePresidente's jellyseerr collection, but it seems like my log isn't being parsed correctly.

Acquisition Metrics:

+----------------------------------------+------------+--------------+----------------+------------------------+
|                 Source                 | Lines read | Lines parsed | Lines unparsed | Lines poured to bucket |
+----------------------------------------+------------+--------------+----------------+------------------------+
| file:/var/log/jellyseerr/overseerr.log | 26         | -            | 26             | -                      |
+----------------------------------------+------------+--------------+----------------+------------------------+

Parser Metrics:

+---------------------------------------+-------+--------+----------+
|                Parsers                | Hits  | Parsed | Unparsed |
+---------------------------------------+-------+--------+----------+
| LePresidente/jellyseerr-logs          | 26    | -      | 26       |
| child-LePresidente/jellyseerr-logs    | 104   | -      | 104      |
+---------------------------------------+-------+--------+----------+

I am running crowdsec and jellyseerr on docker and mounting /var/log/jellyseerr/overseerr.log from the jellyseerr folder to the crowdsec instance, so as not to expose the Docker daemon socket. Then have a acquis.d/jellyseerr.yml to tell it where to find the logs and how to process it:

filenames:
  - /var/log/jellyseerr/overseerr.log
labels:
  type: jellyseerr

The file is mounted correctly, as I can see with docker exec crowdsec cscli metrics above and also by reading the file directly with docker exec crowdsec tail /var/log/jellyseerr/overseerr.log:

2024-01-22T11:40:00.017Z [info][Jobs]: Starting scheduled job: Jellyfin Recently Added Sync 
(...)

Is there a way to debug this and figure out what's going on? It seems like it's reading the logs, just not parsing them.

thanks

It only parsers if the regex matches, have you tried entering a bad username/password combination?

It only parsers if the regex matches, have you tried entering a bad username/password combination?

aye, apologies for my ignorance. It does work perfectly then, thanks :)