From 701b5b077f06ce902288aed7ed4e114cfdc6c5bc Mon Sep 17 00:00:00 2001
From: napnap75 <thomas@nappez.com>
Date: Tue, 8 Sep 2026 23:27:48 +0200
Subject: [PATCH] Split configuration to manage different time format

---
 log-alert/config.json | 42 +++++++++++++++++++++++++++++++++++++++---
 1 file changed, 39 insertions(+), 3 deletions(-)

diff --git a/log-alert/config.json b/log-alert/config.json
index c7f31c1..6fda10c 100644
--- a/log-alert/config.json
+++ b/log-alert/config.json
@@ -58,14 +58,15 @@
                 "message": "New SSH login for {username} on {hostname} from ip {ip} (country: {country}, provider: {isp}, method: {method})"
             }
         },
-        "ssh-local": {
+        "ssh-local-fileserver": {
             "check-interval": 30,
             "log-fetcher": {
                 "name": "parseable",
                 "filters": {
                     "labels": {
                         "filename": "/var/log/host/auth.log",
-                        "process": "sshd"
+                        "process": "sshd",
+                        "hostname": "fileserver"
                     },
                     "text": "Accepted"
                 }
@@ -91,6 +92,41 @@
                 "title": "Local SSH login",
                 "message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
             }
+        },
+        "ssh-local-webserver": {
+            "check-interval": 30,
+            "log-fetcher": {
+                "name": "parseable",
+                "filters": {
+                    "labels": {
+                        "filename": "/var/log/host/auth.log",
+                        "process": "sshd",
+                        "hostname": "webserver"
+                    },
+                    "text": "Accepted"
+                }
+            },
+            "filters": [
+                {
+                    "type": "timestamp",
+                    "config": {
+                        "source-field": "timestamp",
+                        "timezone": "Europe/Paris",
+                        "timestamp-format": "%Y-%m-%dT%H:%M:%S.%f"
+                    }
+                },
+                {
+                    "type": "regexp",
+                    "config": {
+                        "match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
+                    }
+                }
+            ],
+            "alerter": {
+                "name": "gotify",
+                "title": "Local SSH login",
+                "message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
+            }
         }
     }
-}
\ No newline at end of file
+}