CyberMind-FR
32d737483b
- Change evt.Line contains -> evt.Line.Raw contains in parsers (pipeline.Line type requires .Raw accessor for string operations) - Remove invalid filter: field from acquisition configs (filter belongs in parsers, not acquisition files) Fixes CrowdSec v1.7.6 startup failures. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
18 lines
318 B
YAML
18 lines
318 B
YAML
# CrowdSec acquisition for HAProxy logs
|
|
# Monitors HAProxy authentication and access events
|
|
|
|
source: file
|
|
filenames:
|
|
- /var/log/haproxy.log
|
|
- /var/log/haproxy/access.log
|
|
labels:
|
|
type: haproxy
|
|
---
|
|
# HAProxy syslog entries
|
|
source: file
|
|
filenames:
|
|
- /var/log/messages
|
|
- /tmp/log/messages
|
|
labels:
|
|
type: syslog
|