claude BotandClaude Opus 5.5
c2c3926135
Only the color highlight rules are renamed: the Settings tab, the codes column of the log list and the docs. Real filters (source, severity, range, search) keep their name. The internal "filters" tab id is kept so the saved settings tab still opens. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
112 lines
6.4 KiB
Markdown
112 lines
6.4 KiB
Markdown
**English** · [Français](presets.fr.md)
|
||
|
||
# Color tag presets
|
||
|
||
In **Settings › Pattern**, the **+ Preset…** menu adds a group of ready-made color tags in one
|
||
click. Added tags are ordinary tags: you can change their color, pattern or options, or delete
|
||
them. A tag whose pattern is already in the list is not added twice.
|
||
|
||
The list comes from a text file, [`presets.json`](../presets.json), built into LogStream. You
|
||
can replace it with your own file (see [Using your own file](#using-your-own-file)).
|
||
|
||
## Built-in presets
|
||
|
||
### HTTP/HTTPS
|
||
|
||
These presets read access logs from nginx and Apache (common and combined formats), Traefik
|
||
(CLF and JSON), Caddy (JSON) and HAProxy (`option httplog`).
|
||
|
||
| Preset | Tags | What gets colored |
|
||
| --- | --- | --- |
|
||
| HTTP status codes | `HTTP 2xx` green, `HTTP 3xx` blue, `HTTP 4xx` orange, `HTTP 5xx` red | only the status code, e.g. `404` in `"GET /x HTTP/1.1" 404 153`, `"status":404` or `"DownstreamStatus":404`. Other numbers on the line (size, path) are left alone. |
|
||
| HTTP methods | `GET/HEAD/OPTIONS` grey, `POST/PUT/PATCH` purple, `DELETE` pink | only the method in `"GET /path` or `"method":"GET"` (upper case only) |
|
||
| Probes and attacks | `probes / attacks` | `wp-login.php`, `xmlrpc.php`, `wp-admin`, `phpmyadmin`, `/.env`, `/.git`, `/.aws`, `/cgi-bin/`, `../`, `%2e%2e`, `/etc/passwd`, `<script`, `union select` |
|
||
| Bots and scripts | `bots / scripts` | words ending in `bot` (`Googlebot`, `bingbot`…), `crawler`, `spider`, `curl`, `wget`, `python-requests`, `Go-http-client`, `zgrab`, `masscan`, `nmap`, `sqlmap`, `nikto` |
|
||
| TLS/HTTPS and proxy errors | `TLS errors`, `proxy errors` | TLS handshake failures, expired or rejected certificates, `x509:`; `upstream timed out`, `no live upstreams`, `connect() failed`, `connection refused`, `bad gateway`, `gateway timeout`, `service unavailable` |
|
||
|
||
### System
|
||
|
||
| Preset | Tags | What gets colored |
|
||
| --- | --- | --- |
|
||
| SSH and logins | `login failures` red, `logins` green | sshd/PAM: `Failed password`, `Invalid user`, `authentication failure`, `incorrect password attempts`, `NOT in sudoers`…; `Accepted publickey`, `session opened for user`, `New session … of user` |
|
||
| sudo commands | `sudo commands` | the command run, e.g. `COMMAND=/usr/bin/apt` |
|
||
| Kernel: OOM, crashes, disks | `out of memory`, `kernel errors` | `Out of memory`, `oom-killer`, `Killed process 4242`; `Kernel panic`, `BUG:`, `Oops`, `Call Trace`, `segfault at`, `I/O error`, `EXT4-fs error`, `blocked for more than 120 seconds`, `soft lockup` |
|
||
| systemd services | `failed services` red, `service start/stop` green | `Failed to start`, `Failed with result`, `Main process exited, code=killed`, `Start request repeated too quickly`; `Started`, `Stopping`, `Reloaded`, `Reached target` |
|
||
| Firewall and fail2ban | `firewall` | `[UFW BLOCK]`, `[UFW ALLOW]`, `DROP`, `REJECT`, `Ban 203.0.113.9`, `Unban …`, `Found …` |
|
||
|
||
### Applications
|
||
|
||
| Preset | Tags | What gets colored |
|
||
| --- | --- | --- |
|
||
| Docker and containers | `container problems` | `exited with code 137` (non-zero codes only), `OOMKilled`, `unhealthy`, `Back-off restarting`, `CrashLoopBackOff`, `container die/kill/oom` |
|
||
| Databases | `database errors` | PostgreSQL and MySQL/MariaDB: `deadlock detected`, `duplicate key`, `too many connections`, `lock wait timeout`, `slow query`, `server has gone away`, `Access denied for user`, `password authentication failed`… |
|
||
|
||
### General
|
||
|
||
| Preset | Tags | What gets colored |
|
||
| --- | --- | --- |
|
||
| Log levels | `fatal / critical` red, `info / notice` blue, `debug / trace` grey, `ok` green | these words as whole words, any case (the default `warning` and `error` tags cover the rest) |
|
||
| IPv4 addresses | `IPv4 addresses` | `192.168.1.20`, `203.0.113.9`… Four-part version numbers such as `1.2.3.4` are colored too. |
|
||
|
||
When tags overlap, the one highest in the tag list wins, so presets added after the default
|
||
tags never hide them.
|
||
|
||
## Using your own file
|
||
|
||
LogStream reads the file named by `PRESETS_FILE`, `/data/presets.json` by default (in the
|
||
`logstream-data` volume). When the file does not exist, the built-in list is used. The file is
|
||
read again each time Settings is opened: no restart is needed after an edit.
|
||
|
||
With docker-compose, the simplest is to keep the file next to `docker-compose.yml`:
|
||
|
||
1. Copy [`presets.json`](../presets.json) from this repository and edit it.
|
||
2. In `docker-compose.yml`, uncomment the line `- ./presets.json:/config/presets.json:ro`.
|
||
3. In `.env`, set `PRESETS_FILE=/config/presets.json`, then run `docker compose up -d`.
|
||
|
||
If the file is invalid (JSON error, bad regular expression or color, duplicate id), Settings
|
||
shows the error and the built-in list is used until the file is fixed.
|
||
|
||
## File format
|
||
|
||
The file is a JSON list of groups. Each group has a name and a list of presets; each preset has
|
||
an `id`, a name and its tags.
|
||
|
||
```json
|
||
[
|
||
{
|
||
"group": { "en": "My apps", "fr": "Mes applis" },
|
||
"presets": [
|
||
{
|
||
"id": "myapp",
|
||
"name": "My app",
|
||
"tags": [
|
||
{ "label": "payment failed", "color": "#fca5a5", "pattern": "payment (?:failed|refused)" },
|
||
{ "label": "order", "color": "#86efac", "pattern": "order #\\d+" },
|
||
{ "label": "slow", "color": "#fde68a", "pattern": "SLOW", "regex": false, "caseSensitive": true }
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
```
|
||
|
||
| Field | Required | Meaning |
|
||
| --- | --- | --- |
|
||
| `group` | yes | name of the group in the menu |
|
||
| `id` | yes | unique identifier of the preset |
|
||
| `name` | yes | name of the preset in the menu |
|
||
| `tags[].pattern` | yes | what to color: a regular expression, or plain text with `"regex": false` |
|
||
| `tags[].color` | yes | background color, `#rrggbb` |
|
||
| `tags[].label` | no | name shown in the tag list instead of the pattern |
|
||
| `tags[].regex` | no | `true` by default |
|
||
| `tags[].wholeWord` | no | only match whole words, `false` by default |
|
||
| `tags[].caseSensitive` | no | match case, `false` by default |
|
||
|
||
Names and labels are either one text for every language (`"My app"`) or one text per language
|
||
(`{ "en": "My app", "fr": "Mon appli" }`); a missing language falls back to English.
|
||
|
||
Regular expressions must work both in the browser (JavaScript) and in Go, which checks them:
|
||
avoid look-behind `(?<=…)`, look-ahead `(?=…)` and back-references `\1`. In JSON, every
|
||
backslash is written twice: `\d` becomes `"\\d"`. A group named `hl`, `(?<hl>…)`, colors only
|
||
that part of the match, as the HTTP presets do with `(?<hl>5\\d\\d)`.
|