Nginx + Crowdsec on Debian, Unparsed logs
Hi guys,
I just installed Crowdsec and what I noticed is that I have some unparsed logs. I have talked to AI for 2 hours straight and now im wondering if this is even worth fixing or just normal behaviour.
Parser Metrics │
├────────────────────────────────────┬──────┬────────┬──────────┤
│ Parsers │ Hits │ Parsed │ Unparsed │
├────────────────────────────────────┼──────┼────────┼──────────┤
│ child-crowdsecurity/http-logs │ 117 │ 78 │ 39 │
│ child-crowdsecurity/nginx-logs │ 40 │ 20 │ 20 │
│ child-custom/nginx-fallback │ 39 │ 19 │ 20 │
│ crowdsecurity/dateparse-enrich │ 39 │ 39 │ - │
│ crowdsecurity/geoip-enrich │ 39 │ 39 │ - │
│ crowdsecurity/http-logs │ 39 │ 39 │ - │
│ crowdsecurity/nginx-logs │ 20 │ 20 │ - │
│ crowdsecurity/non-syslog │ 39 │ 39 │ - │
│ crowdsecurity/public-dns-allowlist │ 39 │ 39 │ - │
│ crowdsecurity/whitelists │ 39 │ 39 │ - │
│ custom/nginx-fallback │ 39 │ 19 │ 20 │
I just installed Crowdsec and what I noticed is that I have some unparsed logs. I have talked to AI for 2 hours straight and now im wondering if this is even worth fixing or just normal behaviour.
Parser Metrics │
├────────────────────────────────────┬──────┬────────┬──────────┤
│ Parsers │ Hits │ Parsed │ Unparsed │
├────────────────────────────────────┼──────┼────────┼──────────┤
│ child-crowdsecurity/http-logs │ 117 │ 78 │ 39 │
│ child-crowdsecurity/nginx-logs │ 40 │ 20 │ 20 │
│ child-custom/nginx-fallback │ 39 │ 19 │ 20 │
│ crowdsecurity/dateparse-enrich │ 39 │ 39 │ - │
│ crowdsecurity/geoip-enrich │ 39 │ 39 │ - │
│ crowdsecurity/http-logs │ 39 │ 39 │ - │
│ crowdsecurity/nginx-logs │ 20 │ 20 │ - │
│ crowdsecurity/non-syslog │ 39 │ 39 │ - │
│ crowdsecurity/public-dns-allowlist │ 39 │ 39 │ - │
│ crowdsecurity/whitelists │ 39 │ 39 │ - │
│ custom/nginx-fallback │ 39 │ 19 │ 20 │
