Unable to parse NGINX logs
Hello, I've just installed crowdsec, I'm using NGINX as a reverse proxy and logs seems not to be correctly processed. I have followed the guide and added a custom nginx.yaml config file. Files are detectedd but unparsed according to
Here is the example of a line going through the parser:
cscli metrics show acquisitioncscli metrics show acquisitionHere is the example of a line going through the parser:
line: 79.174.34.55 - - [04/Nov/2025:02:53:02 +0100] "GET /xleet-shell.php HTTP/1.1" 404 207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
β s00-raw
| β π΄ crowdsecurity/cri-logs
| β π΄ crowdsecurity/docker-logs
| β π΄ crowdsecurity/syslog-logs
| β π’ crowdsecurity/non-syslog (+5 ~8)
| β update evt.ExpectMode : %!s(int=0) -> 1
| β update evt.Stage : -> s01-parse
| β update evt.Line.Raw : -> 79.174.34.55 - - [04/Nov/2025:02:53:02 +0100] "GET /xleet-shell.php HTTP/1.1" 404 207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
| β update evt.Line.Src : -> /tmp/cscli_explain2478946136/cscli_test_tmp.log
| β update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-11-05 08:53:45.985076811 +0000 UTC
| β create evt.Line.Labels.type : nginx
| β update evt.Line.Process : %!s(bool=false) -> true
| β update evt.Line.Module : -> file
| β create evt.Parsed.message : 79.174.34.55 - - [04/Nov/2025:02:53:02 +0100] "GET /xleet-shell.php HTTP/1.1" 404 207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
| β create evt.Parsed.program : nginx
| β update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-11-05 08:53:45.985083404 +0000 UTC
| β create evt.Meta.datasource_path : /tmp/cscli_explain2478946136/cscli_test_tmp.log
| β create evt.Meta.datasource_type : file
β s01-parse
| β π΄ crowdsecurity/sshd-logs
β-------- parser failure π΄line: 79.174.34.55 - - [04/Nov/2025:02:53:02 +0100] "GET /xleet-shell.php HTTP/1.1" 404 207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
β s00-raw
| β π΄ crowdsecurity/cri-logs
| β π΄ crowdsecurity/docker-logs
| β π΄ crowdsecurity/syslog-logs
| β π’ crowdsecurity/non-syslog (+5 ~8)
| β update evt.ExpectMode : %!s(int=0) -> 1
| β update evt.Stage : -> s01-parse
| β update evt.Line.Raw : -> 79.174.34.55 - - [04/Nov/2025:02:53:02 +0100] "GET /xleet-shell.php HTTP/1.1" 404 207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
| β update evt.Line.Src : -> /tmp/cscli_explain2478946136/cscli_test_tmp.log
| β update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-11-05 08:53:45.985076811 +0000 UTC
| β create evt.Line.Labels.type : nginx
| β update evt.Line.Process : %!s(bool=false) -> true
| β update evt.Line.Module : -> file
| β create evt.Parsed.message : 79.174.34.55 - - [04/Nov/2025:02:53:02 +0100] "GET /xleet-shell.php HTTP/1.1" 404 207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
| β create evt.Parsed.program : nginx
| β update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-11-05 08:53:45.985083404 +0000 UTC
| β create evt.Meta.datasource_path : /tmp/cscli_explain2478946136/cscli_test_tmp.log
| β create evt.Meta.datasource_type : file
β s01-parse
| β π΄ crowdsecurity/sshd-logs
β-------- parser failure π΄
