npmplus:/# cscli explain --log '[26/Jun/2025:12:34:42 +0300] 1.2.3.4 114.217.26.245 0.000 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 444 0 0 - Custom-AsyncHttpClient' --type npmplus -v
line: [26/Jun/2025:12:34:42 +0300] 1.2.3.4 114.217.26.245 0.000 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 444 0 0 - Custom-AsyncHttpClient
        ├ s00-raw
        |       ├ 🔴 crowdsecurity/cri-logs
        |       ├ 🔴 crowdsecurity/docker-logs
        |       ├ 🔴 crowdsecurity/syslog-logs
        |       └ 🟢 crowdsecurity/non-syslog (+5 ~8)
        |               └ update evt.ExpectMode : %!s(int=0) -> 1
        |               └ update evt.Stage :  -> s01-parse
        |               └ update evt.Line.Raw :  -> [26/Jun/2025:12:34:42 +0300] 1.2.3.4 114.217.26.245 0.000 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 444 0 0 - Custom-AsyncHttpClient
        |               └ update evt.Line.Src :  -> /tmp/cscli_explain2737046598/cscli_test_tmp.log
        |               └ update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-06-26 18:29:06.692580262 +0000 UTC
        |               └ create evt.Line.Labels.type : npmplus
        |               └ update evt.Line.Process : %!s(bool=false) -> true
        |               └ update evt.Line.Module :  -> file
        |               └ create evt.Parsed.message : [26/Jun/2025:12:34:42 +0300] 1.2.3.4 114.217.26.245 0.000 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 444 0 0 - Custom-AsyncHttpClient
        |               └ create evt.Parsed.program : npmplus
        |               └ update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-06-26 18:29:06.692753027 +0000 UTC
        |               └ create evt.Meta.datasource_path : /tmp/cscli_explain2737046598/cscli_test_tmp.log
        |               └ create evt.Meta.datasource_type : file
        ├ s01-parse
        |       ├ 🔴 crowdsecurity/appsec-logs
        |       ├ 🔴 crowdsecurity/modsecurity
        |       └ 🟢 ZoeyVid/npmplus-logs (+20 ~2)
        |               └ update evt.Stage : s01-parse -> s01-whitelist
        |               └ create evt.Parsed.bytes_sent : 0
        |               └ create evt.Parsed.http_user_agent : Custom-AsyncHttpClient
        |               └ create evt.Parsed.http_version : 1.1
        |               └ create evt.Parsed.remote_addr : 114.217.26.245
        |               └ create evt.Parsed.request_time : 0.000
        |               └ create evt.Parsed.status : 444
        |               └ create evt.Parsed.target_fqdn : 1.2.3.4
        |               └ create evt.Parsed.verb : POST
        |               └ create evt.Parsed.body_bytes_sent : 0
        |               └ create evt.Parsed.http_referer : -
        |               └ create evt.Parsed.request : /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
        |               └ create evt.Parsed.time_local : 26/Jun/2025:12:34:42 +0300
        |               └ update evt.StrTime :  -> 26/Jun/2025:12:34:42 +0300
        |               └ create evt.Meta.http_user_agent : Custom-AsyncHttpClient
        |               └ create evt.Meta.http_verb : POST
        |               └ create evt.Meta.log_type : http_access-log
        |               └ create evt.Meta.source_ip : 114.217.26.245
        |               └ create evt.Meta.http_status : 444
        |               └ create evt.Meta.service : http
        |               └ create evt.Meta.target_fqdn : 1.2.3.4
        |               └ create evt.Meta.http_path : /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
        ├ s01-whitelist
        |       └ 🟢 custom/my-whitelists (unchanged)
        └-------- parser failure 🔴