Split configuration to manage different time format

This commit is contained in:
2026-09-08 23:27:48 +02:00
committed by GitHub
parent f4c2628e0c
commit 701b5b077f
+39 -3
View File
@@ -58,14 +58,15 @@
"message": "New SSH login for {username} on {hostname} from ip {ip} (country: {country}, provider: {isp}, method: {method})"
}
},
"ssh-local": {
"ssh-local-fileserver": {
"check-interval": 30,
"log-fetcher": {
"name": "parseable",
"filters": {
"labels": {
"filename": "/var/log/host/auth.log",
"process": "sshd"
"process": "sshd",
"hostname": "fileserver"
},
"text": "Accepted"
}
@@ -91,6 +92,41 @@
"title": "Local SSH login",
"message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
}
},
"ssh-local-webserver": {
"check-interval": 30,
"log-fetcher": {
"name": "parseable",
"filters": {
"labels": {
"filename": "/var/log/host/auth.log",
"process": "sshd",
"hostname": "webserver"
},
"text": "Accepted"
}
},
"filters": [
{
"type": "timestamp",
"config": {
"source-field": "timestamp",
"timezone": "Europe/Paris",
"timestamp-format": "%Y-%m-%dT%H:%M:%S.%f"
}
},
{
"type": "regexp",
"config": {
"match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
}
}
],
"alerter": {
"name": "gotify",
"title": "Local SSH login",
"message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
}
}
}
}
}