diff --git a/Dockerfile b/Dockerfile index 9eabf60..0164e81 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM debian:latest MAINTAINER Kameron Kenny -LABEL version="20240621.2.1" +LABEL version="20240621.2.2" LABEL description="Debian Based syslog-ng" RUN apt-get update diff --git a/config/syslog-ng.conf.d/bind-dns.conf b/config/syslog-ng.conf.d/bind-dns.conf index 9817000..5e5e07a 100644 --- a/config/syslog-ng.conf.d/bind-dns.conf +++ b/config/syslog-ng.conf.d/bind-dns.conf @@ -20,7 +20,7 @@ parser p_bind_message { ); }; -rewrite r_docker_header { +rewrite r_bind_docker_header { subst("5000\/tlp\/", "", value("docker")); subst(":", " ", value("docker")); subst(":", " ", value("docker")); @@ -29,7 +29,7 @@ rewrite r_docker_header { subst('\]', " ", value("docker")); }; -parser p_docker_header { +parser p_bind_docker_header { csv-parser( template("${docker}") flags(strip-whitespace) @@ -73,8 +73,8 @@ log { source(s_network_udp); filter(f_bind9); parser(p_bind_message); - rewrite(r_docker_header); - parser(p_docker_header); + rewrite(r_bind_docker_header); + parser(p_bind_docker_header); parser(p_client_ip_port); parser(p_bind_client_ip_geoip2_city); destination(d_bind_logs); diff --git a/config/syslog-ng.conf.d/nginx.conf b/config/syslog-ng.conf.d/nginx.conf index 71afeb5..4108b1b 100644 --- a/config/syslog-ng.conf.d/nginx.conf +++ b/config/syslog-ng.conf.d/nginx.conf @@ -1,17 +1,5 @@ filter f_nginx { match("nginx" value("PROGRAM")); }; -rewrite r_docker_image { - subst("^5000/tlp/", "image:", value("MESSAGE")); - subst(":(?=(\d*\.\d*\.\d*))", " version:", value("MESSAGE")); - subst('(\/)(?=\S*\[)', " container_name:", value("MESSAGE")); - subst('((?!=container_name:(\S*))\[(?=\d*))', " pid:", value("MESSAGE")); - subst('((?!=pid:(\d*))\]:)', "", value("MESSAGE")); - subst('((?!=pid:(\d*))\ )', " datetime:", value("MESSAGE")); - subst('((?!=datetime:(\d*-\w*-\d*))\ )', "_", value("MESSAGE")); - subst('((?!=datetime:(\d*-\w*-\d*_\d*)):)', ".", value("MESSAGE")); - subst('((?!=datetime:(\d*-\w*-\d*_\d*\.\d*)):)', ".", value("MESSAGE")); -}; - parser p_nginx_message { csv-parser( dialect(escape-double-char) @@ -22,14 +10,14 @@ parser p_nginx_message { ); }; -rewrite r_docker_header { +rewrite r_nginx_docker_header { subst(":", " ", value("docker")); subst("\/", " ", value("docker")); subst('\[', " ", value("docker")); subst('\]', " ", value("docker")); }; -parser p_docker_header { +parser p_nginx_docker_header { csv-parser( template("${docker}") flags(strip-whitespace) @@ -64,8 +52,8 @@ log { source(s_network_udp); filter(f_nginx); parser(p_nginx_message); - rewrite(r_docker_header); - parser(p_docker_header); + rewrite(r_nginx_docker_header); + parser(p_nginx_docker_header); parser(p_nginx_client_ip_geoip2_city); destination(d_nginx_logs); flags(final); diff --git a/docker-compose.yml b/docker-compose.yml index 8a9f13e..09b4faa 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,7 +10,7 @@ services: syslog-ng: build: dockerfile: Dockerfile - image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240621.2.1 + image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240621.2.2 container_name: syslog-ng restart: unless-stopped networks: