You definitely should get more count in the parsed column.
But when I read the config I pasted you I found a nasty typo: type: gelp-nginx
in the 1. should match the nginx-gelp
in the filter lin in the 2. These two entries should match in order the parser to know which type of log it’s working on.
Replacing you /etc/crowdsec/config/acquis.yaml
with
filenames:
- /var/log/<the generated gelp-nginx log file>
labels:
type: nginx-gelp
should do the trick
Sorry for this