# CONFIGURED BY ANSIBLE

#
# parse netbird server container logs
#

# 2024-06-22T09:25:24Z INFO signal/server/signal.go:58: peer disconnected [z0a06L2ieBAzenCZlFRKt8ll6/7I3l7UP0qvcSgApjk=] [streamID 1719048188966711512]
# no need to handle the remaining white-space with INFO, because WARN doesn't include any
[PARSER]
    name   netbird_srv_logs
    format regex
    regex  ^[^ ]+ (?<level>[A-Z]+) (?<file>[^ ]+): (?<msg>.*)$

# 178.205.51.19 - - [22/Jun/2024:15:26:57 +0000] "GET /assets/flags/4x3/ru.svg HTTP/1.1" 200 212 "https://vpn.infra.cluster.kznexpess.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-"
[PARSER]
    name   netbird_srv_http_logs
    format regex
    # https://rubular.com/
    #regex  ^[0-9.]+ - - \[[^\]]+\] "[^\"]+" [^ ]+ [^ ]+ "[^\"]+" "[^\"]+" "[^\"]+"$
    regex  ^(?<endpoint_ip>[0-9.]+) - - \[[^\]]+\] "(?<msg>[^\"]+)" [^ ]+ [^ ]+ "[^\"]+" "[^\"]+" "[^\"]+"$