line: {"@timestamp": "2025-09-02T07:55:48+00:00", "_ym_uid": "1755531811525907277" , "request_id": "2fd0b9b5873c07e44fd790d4ffcf0116", "remote_addr": "45.82.64.192","time_local": "02/Sep/2025:07:55:48 +0000","request": "/favicon-32x32.png","request_length": 199,"request_time": 0.003,"request_method": "GET","status": 200,"vhost": "site.online","body_bytes_sent": 1268,"namespace": "site-online","ingress_name": "main","server_protocol": "HTTP/2.0","service": {"name": "simple-cdn","port": "8080"},"proxy": {"protocol_addr": "-","upstream_name": "site-online-simple-cdn-8080","add_x_forwarded_for": "45.82.64.192"},"http": {"referer": "https://site.online/","user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","accept_encoding": "gzip, deflate, br, zstd"},"upstream": {"addr": "10.112.172.215:8080","response_length": 1268,"response_time": 0.003,"status": 200,"location": "-","connect_time": 0.000,"response_length_string": "1268","response_time_string": "0.003","status_string": "200","connect_time_string": "0.000"}} ├ s00-raw | ├ 🔴 crowdsecurity/cri-logs | ├ 🔴 crowdsecurity/docker-logs | ├ 🔴 crowdsecurity/syslog-logs | └ 🟢 crowdsecurity/non-syslog (+5 ~8) | └ update evt.ExpectMode : %!s(int=0) -> 1 | └ update evt.Stage : -> s01-parse | └ update evt.Line.Raw : -> {"@timestamp": "2025-09-02T07:55:48+00:00", "_ym_uid": "1755531811525907277" , "request_id": "2fd0b9b5873c07e44fd790d4ffcf0116", "remote_addr": "45.82.64.192","time_local": "02/Sep/2025:07:55:48 +0000","request": "/favicon-32x32.png","request_length": 199,"request_time": 0.003,"request_method": "GET","status": 200,"vhost": "site.online","body_bytes_sent": 1268,"namespace": "site-online","ingress_name": "main","server_protocol": "HTTP/2.0","service": {"name": "simple-cdn","port": "8080"},"proxy": {"protocol_addr": "-","upstream_name": "site-online-simple-cdn-8080","add_x_forwarded_for": "45.82.64.192"},"http": {"referer": "https://site.online/","user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","accept_encoding": "gzip, deflate, br, zstd"},"upstream": {"addr": "10.112.172.215:8080","response_length": 1268,"response_time": 0.003,"status": 200,"location": "-","connect_time": 0.000,"response_length_string": "1268","response_time_string": "0.003","status_string": "200","connect_time_string": "0.000"}} | └ update evt.Line.Src : -> /tmp/cscli_explain4018434441/cscli_test_tmp.log | └ update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-09-02 07:58:45.230604989 +0000 UTC | └ create evt.Line.Labels.type : nginx | └ update evt.Line.Process : %!s(bool=false) -> true | └ update evt.Line.Module : -> file | └ create evt.Parsed.message : {"@timestamp": "2025-09-02T07:55:48+00:00", "_ym_uid": "1755531811525907277" , "request_id": "2fd0b9b5873c07e44fd790d4ffcf0116", "remote_addr": "45.82.64.192","time_local": "02/Sep/2025:07:55:48 +0000","request": "/favicon-32x32.png","request_length": 199,"request_time": 0.003,"request_method": "GET","status": 200,"vhost": "site.online","body_bytes_sent": 1268,"namespace": "site-online","ingress_name": "main","server_protocol": "HTTP/2.0","service": {"name": "simple-cdn","port": "8080"},"proxy": {"protocol_addr": "-","upstream_name": "site-online-simple-cdn-8080","add_x_forwarded_for": "45.82.64.192"},"http": {"referer": "https://site.online/","user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","accept_encoding": "gzip, deflate, br, zstd"},"upstream": {"addr": "10.112.172.215:8080","response_length": 1268,"response_time": 0.003,"status": 200,"location": "-","connect_time": 0.000,"response_length_string": "1268","response_time_string": "0.003","status_string": "200","connect_time_string": "0.000"}} | └ create evt.Parsed.program : nginx | └ update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-09-02 07:58:45.230657049 +0000 UTC | └ create evt.Meta.datasource_path : /tmp/cscli_explain4018434441/cscli_test_tmp.log | └ create evt.Meta.datasource_type : file ├ s01-parse | └ 🟢 crowdsecurity/custom-nginx-logs (+24 ~2) | └ update evt.Stage : s01-parse -> s02-enrich | └ create evt.Parsed.http_referer : https://site.online/ | └ create evt.Parsed.http_user_agent : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | └ create evt.Parsed.proxy_upstream_name : site-online-simple-cdn-8080 | └ create evt.Parsed.request_time : 0.003 | └ create evt.Parsed.status : 200 | └ create evt.Parsed.target_fqdn : site.online | └ create evt.Parsed.http_version : HTTP/2.0 | └ create evt.Parsed.remote_addr : 45.82.64.192 | └ create evt.Parsed.remote_user : - | └ create evt.Parsed.request : /favicon-32x32.png | └ create evt.Parsed.request_length : 199 | └ create evt.Parsed.time_local : 02/Sep/2025:07:55:48 +0000 | └ create evt.Parsed.verb : GET | └ create evt.Parsed.port : - | └ create evt.Parsed.proxy_alternative_upstream_name : 10.112.172.215:8080 | └ create evt.Parsed.body_bytes_sent : 1268 | └ update evt.StrTime : -> 2025-09-02T07:55:48+00:00 | └ create evt.Meta.http_status : 200 | └ create evt.Meta.source_ip : 45.82.64.192 | └ create evt.Meta.http_path : /favicon-32x32.png | └ create evt.Meta.http_user_agent : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | └ create evt.Meta.http_verb : GET | └ create evt.Meta.log_type : http_access-log | └ create evt.Meta.service : http | └ create evt.Meta.target_fqdn : site.online ├ s02-enrich | ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2) | ├ create evt.Enriched.MarshaledTime : 2025-09-02T07:55:48Z | ├ update evt.Time : 2025-09-02 07:58:45.230657049 +0000 UTC -> 2025-09-02 07:55:48 +0000 UTC | ├ update evt.MarshaledTime : -> 2025-09-02T07:55:48Z | ├ create evt.Meta.timestamp : 2025-09-02T07:55:48Z | ├ 🟢 crowdsecurity/geoip-enrich (+13) | ├ create evt.Enriched.ASNOrg : WorldStream B.V. | ├ create evt.Enriched.IsoCode : NL | ├ create evt.Enriched.Latitude : 51.996800 | ├ create evt.Enriched.Longitude : 4.205700 | ├ create evt.Enriched.SourceRange : 45.82.64.0/22 | ├ create evt.Enriched.ASNNumber : 49981 | ├ create evt.Enriched.ASNumber : 49981 | ├ create evt.Enriched.IsInEU : true | ├ create evt.Meta.IsoCode : NL | ├ create evt.Meta.IsInEU : true | ├ create evt.Meta.ASNNumber : 49981 | ├ create evt.Meta.ASNOrg : WorldStream B.V. | ├ create evt.Meta.SourceRange : 45.82.64.0/22 | ├ 🟢 crowdsecurity/http-logs (+7) | ├ create evt.Parsed.static_ressource : true | ├ create evt.Parsed.file_frag : favicon-32x32 | ├ create evt.Parsed.file_name : favicon-32x32.png | ├ create evt.Parsed.file_ext : .png | ├ create evt.Parsed.impact_completion : true | ├ create evt.Parsed.file_dir : / | ├ create evt.Meta.http_args_len : 0 | ├ 🟢 crowdsecurity/public-dns-allowlist (unchanged) | └ 🟢 crowdsecurity/whitelists (unchanged) ├-------- parser success 🟢 ├ Scenarios