parsers/s01-parse/xs539/joplin-server-logs.md | Doesn´t work with Docker as a source

[Crash1602]

Hello,

I have the Joplin server running as a Docker container. Unfortunately, the required joplin-server.log is not being generated in the mounted folder - hence, integrating it into the Crowdsec container is not feasible for me. I have now installed the collection xs539/joplin-server on the Docker host and integrated Joplin as follows:

source: docker
container_name:
 - joplin-prod 
labels:
  type: joplin-server

A log is recognized and processed but not parsed. The log output of the Joplin container does not seem to match the parser. Perhaps it is possible for the owner to extend the parser/create one for the Docker variant.

Thanks.

Best regards,
Crash1602

[LaurenceJJones]

Perhaps it is possible for the owner to extend the parser/create one for the Docker variant.

Could you provide some example log lines, you can redact any PII data such as username or IP with there respected placeholders <username> or <IP>.

[Crash1602]

I don't know if the specified source will also read these logs, but when I query the logs, unfortunately, I don't receive any IP information, but somewhere (I think) this information should be available.

docker logs -f <container name>

I get the log output when I try to log in (specifically with incorrect data):

14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /login (200) (1ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /css/bulma.min.css (200) (1ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /css/fontawesome/css/all.min.css (200) (2ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /js/jquery.min.js (200) (2ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /css/main.css (200) (5ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /images/server_logo.png (200) (4ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /js/main.js (200) (3ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /images/icons/server/manifest.webmanifest (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: TaskService: Running #11 (Process shared items) (scheduled)...
14:55:19 0|app    | 2024-11-22 14:55:19: TaskService: Completed #11 (Process shared items) in 10ms
14:55:19 0|app    | 2024-11-22 14:55:19: App: POST /login (403) (2ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /css/bulma.min.css (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /js/jquery.min.js (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /css/fontawesome/css/all.min.css (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /css/main.css (200) (2ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /js/main.js (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /images/server_logo.png (200) (0ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /images/icons/server/manifest.webmanifest (200) (1ms)

[LaurenceJJones]

I don't know if the specified source will also read these logs, but when I query the logs, unfortunately, I don't receive any IP information, but somewhere (I think) this information should be available.

docker logs -f <container name>

I get the log output when I try to log in (specifically with incorrect data):

14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /login (200) (1ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /css/bulma.min.css (200) (1ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /css/fontawesome/css/all.min.css (200) (2ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /js/jquery.min.js (200) (2ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /css/main.css (200) (5ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /images/server_logo.png (200) (4ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /js/main.js (200) (3ms)
14:55:09 0|app    | 2024-11-22 14:55:09: App: GET /images/icons/server/manifest.webmanifest (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: TaskService: Running #11 (Process shared items) (scheduled)...
14:55:19 0|app    | 2024-11-22 14:55:19: TaskService: Completed #11 (Process shared items) in 10ms
14:55:19 0|app    | 2024-11-22 14:55:19: App: POST /login (403) (2ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /css/bulma.min.css (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /js/jquery.min.js (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /css/fontawesome/css/all.min.css (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /css/main.css (200) (2ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /js/main.js (200) (1ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /images/server_logo.png (200) (0ms)
14:55:19 0|app    | 2024-11-22 14:55:19: App: GET /images/icons/server/manifest.webmanifest (200) (1ms)

It may look like the container stdout only has "basic" api logs, and there is a log line that output the actual logging directory: https://github.com/laurent22/joplin/blob/380ba28bac539049ca27c2472a39818cdc9a099f/packages/server/src/app.ts#L315C3-L315C49 so you may have to read these logs within the container instead relying on the container stdout.