Hi, I have some problems with the modsecurity parser.
My setup seems ok but I always get zero parsed lines from log analysis even with modsecurity critical notification.
My acquis.yaml file:
filenames:
- /var/log/apache2/error.log
labels:
type: modsecurity
---
Parser metrics:
Parsers │ Hits │ Parsed │ Unparsed │
├──────────────────────────────────┼────────┼────────┼──────────┤
│ child-crowdsecurity/apache2-logs │ 8.54k │ 7.04k │ 1.50k │
│ child-crowdsecurity/http-logs │ 21.12k │ 16.88k │ 4.24k │
│ child-crowdsecurity/modsecurity │ 3.00k │ - │ 3.00k │
│ child-crowdsecurity/syslog-logs │ 9.96k │ 9.96k │ - │
│ crowdsecurity/apache2-logs │ 7.04k │ 7.04k │ - │
│ crowdsecurity/cdn-whitelist │ 1 │ 1 │ - │
│ crowdsecurity/dateparse-enrich │ 7.04k │ 7.04k │ - │
│ crowdsecurity/geoip-enrich │ 7.04k │ 7.04k │ - │
│ crowdsecurity/http-logs │ 7.04k │ 5.48k │ 1.56k │
│ crowdsecurity/modsecurity │ 1.50k │ - │ 1.50k │
│ crowdsecurity/non-syslog │ 8.54k │ 8.54k │ - │
│ crowdsecurity/rdns │ 1 │ 1 │ - │
│ crowdsecurity/seo-bots-whitelist │ 1 │ 1 │ - │
│ crowdsecurity/syslog-logs │ 9.96k │ 9.96k │ - │
│ crowdsecurity/whitelists │ 7.04k │ 7.04k │ - │
What am I doing wrong?
Thank you