Skip to content

Instantly share code, notes, and snippets.

@agup006
agup006 / parsers
Last active October 24, 2024 13:31
includes catch-all parser that puts entire message in "message field"
[PARSER]
Name catch-all
Format regex
Regex (?<message>.*)
[PARSER]
Name syslog-rfc5424
Format regex
Regex ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$
Time_Key time
@agup006
agup006 / test.json
Last active September 27, 2024 17:20
{
"consumerDevice": {
"name": "myDevice1",
"consumerDeviceLocation": {
"name": "myLocation",
"consumerAccount": {
"consumerUsers": [
{
"user": {
"id": "56bce063-f596-4ebe-a603-c0887b37a97b",
[PARSER]
Name apache
Format regex
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
Time_Key time
Time_Format %d/%b/%Y:%H:%M:%S %z
[PARSER]
Name apache2
Format regex
# Taken from https://docs.k3s.io/installation/airgap#prepare-the-images-directory-and-k3s-binary
runAsRoot mkdir -p /var/lib/rancher/k3s/agent/images/ "$BINARY_DIR"/
runAsRoot cp -fv "$CALYPTIA_ROOT/k3s/k3s-airgap-images-$ARCH.tar" /var/lib/rancher/k3s/agent/images/
runAsRoot chmod a+r /var/lib/rancher/k3s/agent/images/*.tar
local k3s_exe=k3s
if [[ "$ARCH" != "amd64" ]]; then
k3s_exe="k3s-$ARCH"
fi
runAsRoot cp -f "$CALYPTIA_ROOT/k3s/$k3s_exe" "$BINARY_DIR"/
runAsRoot chmod 755 "$BINARY_DIR/$k3s_exe"
@agup006
agup006 / append.lua
Last active September 14, 2023 15:26
function cb_filter(tag, timestamp, record)
record.tag = tag
return 1, timestamp, record
end
#!/bin/bash
set -eu
# Make sure to do this first for Openshift
if [[ "${SKIP_SA:-no}" != "no" ]]; then
echo "Skipping service account creation"
fi
NAMESPACE=calyptia
function process(tag, timestamp, record)
-- Splitting the log by tabs to extract the fields
local fields = {}
for field in string.gmatch(record["log"], "([^\t]+)") do
table.insert(fields, field)
end
-- Extracting fields from the split log
local date = fields[1]
local time = fields[2]
# This is a sample configuration for Calyptia Fluent Bit
# This reads logs from the server and routes them to standard output
[INPUT]
tag dummy.4aaf0fd6-0f0c-47a3-92b1-7432382f5f3f
Name dummy
rate 1
dummy {"message":"hello world"}
samples 0
start_time_sec -1
@agup006
agup006 / Windows Config Events
Last active July 9, 2023 21:02
The following are configuration files for collecting Windows events and Windows metrics
[INPUT]
Name winevtlog
Channels Setup,Windows PowerShell
Interval_Sec 1
DB winevtlog.sqlite
[OUTPUT]
Name stdout
Match *
Description: EC2 Instance with Calyptia Core
Mappings:
RegionsAmis:
us-east-1:
'111': ami-0e7c24109670b64ec
us-east-2:
'111': ami-014087e40c89090ec
Parameters:
Version:
AllowedValues: