style: 💄 make modsec debug logs more readable (#112)

ministryofjustice · Nov 26, 2024 · 62c8bab · 62c8bab
1 parent c88b796
commit 62c8bab
Showing 1 changed file with 13 additions and 1 deletion.
diff --git a/configmap.tf b/configmap.tf
@@ -88,6 +88,12 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Merge_Log_Key       log_processed
         Buffer_Size         5MB
 
+    [FILTER]
+        Name                              parser
+        Parser                            modsec-debug-logs
+        Match                             cp-ingress-modsec-debug.*
+        Key_Name                          log
+
     [FILTER]
         Name                              lua
         Match                             cp-ingress-modsec-stdout.*
@@ -186,7 +192,13 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
         Time_Key    time
         Time_Format %Y-%m-%dT%H:%M:%S.%L%z
-
+    [PARSER]
+        # https://rubular.com/r/DjPmoX5HnQMesk
+        Name modsec-debug-logs
+        Format regex
+        Regex ^(?<debug_uid>\[\d+\.\d+\]) (?<uri>\[.*\]) (?<log>.*)$
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L%z
     [PARSER]
         Name         generic-json
         Format       json