logsieve/sample-extractors.json at main · McIndi/logsieve · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
{
  "extractors": [
    {
      "id": "apache-common",
      "name": "Apache Common Log Format",
      "pattern": "^(?<ip>\\S+) \\S+ \\S+ \\[(?<ts>[^\\]]+)\\] \"(?<method>\\w+) (?<path>\\S+) (?<protocol>[^\"]+)\" (?<status>\\d+) (?<bytes>\\d+)",
      "description": "Parse Apache/Nginx access logs in Common Log Format",
      "enabled": true,
      "created": "2025-11-12T00:00:00Z"
    },
    {
      "id": "bracketed-standard",
      "name": "Bracketed Log Format",
      "pattern": "^\\[(?<ts>[^\\]]+)\\]\\s+(?<level>\\w+)\\s+(?<message>.*)",
      "description": "Standard format: [timestamp] LEVEL message",
      "enabled": true,
      "created": "2025-11-12T00:00:00Z"
    },
    {
      "id": "user-action",
      "name": "User Action Extractor",
      "pattern": "User\\s+(?<user>\\w+)\\s+(?<action>\\w+)",
      "description": "Extract username and action from log messages",
      "enabled": false,
      "created": "2025-11-12T00:00:00Z"
    },
    {
      "id": "ip-extractor",
      "name": "IP Address Extractor",
      "pattern": "(?<ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})",
      "description": "Extract IP addresses from log messages",
      "enabled": false,
      "created": "2025-11-12T00:00:00Z"
    },
    {
      "id": "key-value",
      "name": "Key-Value Pairs",
      "pattern": "(?<key>\\w+)=(?<value>\\S+)",
      "description": "Extract key=value pairs from logs",
      "enabled": false,
      "created": "2025-11-12T00:00:00Z"
    }
  ],
  "filters": [
    {
      "id": "errors-only",
      "name": "Errors Only",
      "description": "Show only ERROR and CRITICAL level logs",
      "query": "",
      "level": "ERROR",
      "from": "",
      "to": "",
      "regex": "",
      "sort": "ts",
      "order": "desc",
      "created": "2025-11-12T00:00:00Z"
    },
    {
      "id": "recent-critical",
      "name": "Recent Critical Issues",
      "description": "Critical errors sorted by most recent",
      "query": "",
      "level": "CRITICAL",
      "from": "",
      "to": "",
      "regex": "",
      "sort": "ts",
      "order": "desc",
      "created": "2025-11-12T00:00:00Z"
    },
    {
      "id": "user-activity",
      "name": "User Activity",
      "description": "Track user login/logout events",
      "query": "logged",
      "level": "",
      "from": "",
      "to": "",
      "regex": "",
      "sort": "ts",
      "order": "asc",
      "created": "2025-11-12T00:00:00Z"
    }
  ],
  "activeExtractors": [],
  "prefs": {
    "defaultPageSize": 50,
    "extractorMergeStrategy": "last-wins"
  },
  "exportDate": "2025-11-12T00:00:00Z",
  "version": "1.0"
}