Creating a file (non syslog) parser and the filter:

[baudneo]

I have been told to not post questions in the discourse and also ask question in the discord sever so I am removing all my posts from discourse.

[baudneo]

I have been told to not post questions in the discourse and also ask question in the discord sever so I am removing all my posts from discourse.

[thibault]

Hey @baudneo

Thanks for your message !

@baudneo

So when I write a parser I need to set filter: "evt.Parsed.program == 'zoneminder-web_php'" . Does this mean the end-user will need to add this line to their acquis.yaml themselves? Or how can I have that part automated?

Yes, in the current state, if the service is not detected by the wizard, the user has to manually add the entries in his acquis.yaml/acquis.d file/directory.

Hopefully in the soon future, cscli collections add will as well generate the acquis file for the collection

@baudneo

I’ve got a few parsers and scenarios I’m trying to add to the hub but the docs are extremely sparse and hard to apply.

Can you let me know what parts are too sparse or what you would be looking for ? We’ll be happy to improve it, doc is a never ending effort, please bear with us. Hopefully this for parsers and that for scenarios might help !

@baudneo

It seems to me that all the contributed parsers are for syslog only.

You can, there is no restrictions on syslog-only or 3rd part log format.

Don’t hesitate to jump on discord, and we’ll be happy to help !