line: {"@timestamp": "2025-09-02T08:27:15+00:00", "_ym_uid": "1755531811525907277" , "request_id": "386ac2fb4058ca99df87c92fca92dfaa", "remote_addr": "45.82.64.192","time_local": "02/Sep/2025:08:27:15 +0000","request": "/discounts?_rsc=1omfx","request_length": 1002,"request_time": 0.020,"request_method": "GET","status": 200,"vhost": "new.site.online","body_bytes_sent": 2034,"namespace": "site-online","ingress_name": "new-site-online","server_protocol": "HTTP/2.0","service": {"name": "ithaca-production","port": "3000"},"proxy": {"protocol_addr": "-","upstream_name": "site-online-ithaca-production-3000","add_x_forwarded_for": "45.82.64.192"},"http": {"referer": "https://new.site.online/ships/celestyal-discovery","user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","accept_encoding": "gzip, deflate, br, zstd"},"upstream": {"addr": "10.112.189.44:3000","response_length": 2051,"response_time": 0.006,"status": 200,"location": "-","connect_time": 0.001,"response_length_string": "2051","response_time_string": "0.006","status_string": "200","connect_time_string": "0.001"} ├ s00-raw | ├ 🔴 crowdsecurity/cri-logs | ├ 🔴 crowdsecurity/docker-logs | ├ 🔴 crowdsecurity/syslog-logs | └ 🟢 crowdsecurity/non-syslog (+5 ~8) | └ update evt.ExpectMode : %!s(int=0) -> 1 | └ update evt.Stage : -> s01-parse | └ update evt.Line.Raw : -> {"@timestamp": "2025-09-02T08:27:15+00:00", "_ym_uid": "1755531811525907277" , "request_id": "386ac2fb4058ca99df87c92fca92dfaa", "remote_addr": "45.82.64.192","time_local": "02/Sep/2025:08:27:15 +0000","request": "/discounts?_rsc=1omfx","request_length": 1002,"request_time": 0.020,"request_method": "GET","status": 200,"vhost": "new.site.online","body_bytes_sent": 2034,"namespace": "site-online","ingress_name": "new-site-online","server_protocol": "HTTP/2.0","service": {"name": "ithaca-production","port": "3000"},"proxy": {"protocol_addr": "-","upstream_name": "site-online-ithaca-production-3000","add_x_forwarded_for": "45.82.64.192"},"http": {"referer": "https://new.site.online/ships/celestyal-discovery","user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","accept_encoding": "gzip, deflate, br, zstd"},"upstream": {"addr": "10.112.189.44:3000","response_length": 2051,"response_time": 0.006,"status": 200,"location": "-","connect_time": 0.001,"response_length_string": "2051","response_time_string": "0.006","status_string": "200","connect_time_string": "0.001"} | └ update evt.Line.Src : -> /tmp/cscli_explain3652648390/cscli_test_tmp.log | └ update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-09-02 09:32:29.405689815 +0000 UTC | └ create evt.Line.Labels.type : nginx | └ update evt.Line.Process : %!s(bool=false) -> true | └ update evt.Line.Module : -> file | └ create evt.Parsed.message : {"@timestamp": "2025-09-02T08:27:15+00:00", "_ym_uid": "1755531811525907277" , "request_id": "386ac2fb4058ca99df87c92fca92dfaa", "remote_addr": "45.82.64.192","time_local": "02/Sep/2025:08:27:15 +0000","request": "/discounts?_rsc=1omfx","request_length": 1002,"request_time": 0.020,"request_method": "GET","status": 200,"vhost": "new.site.online","body_bytes_sent": 2034,"namespace": "site-online","ingress_name": "new-site-online","server_protocol": "HTTP/2.0","service": {"name": "ithaca-production","port": "3000"},"proxy": {"protocol_addr": "-","upstream_name": "site-online-ithaca-production-3000","add_x_forwarded_for": "45.82.64.192"},"http": {"referer": "https://new.site.online/ships/celestyal-discovery","user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","accept_encoding": "gzip, deflate, br, zstd"},"upstream": {"addr": "10.112.189.44:3000","response_length": 2051,"response_time": 0.006,"status": 200,"location": "-","connect_time": 0.001,"response_length_string": "2051","response_time_string": "0.006","status_string": "200","connect_time_string": "0.001"} | └ create evt.Parsed.program : nginx | └ update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-09-02 09:32:29.405751013 +0000 UTC | └ create evt.Meta.datasource_type : file | └ create evt.Meta.datasource_path : /tmp/cscli_explain3652648390/cscli_test_tmp.log ├ s01-parse | └ 🟢 crowdsecurity/custom-nginx-logs (+24 ~2) | └ update evt.Stage : s01-parse -> s02-enrich | └ create evt.Parsed.remote_user : - | └ create evt.Parsed.http_user_agent : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | └ create evt.Parsed.proxy_alternative_upstream_name : 10.112.189.44:3000 | └ create evt.Parsed.request : /discounts?_rsc=1omfx | └ create evt.Parsed.request_time : 0.020 | └ create evt.Parsed.status : 200 | └ create evt.Parsed.target_fqdn : new.site.online | └ create evt.Parsed.body_bytes_sent : 2034 | └ create evt.Parsed.http_referer : https://new.site.online/ships/celestyal-discovery | └ create evt.Parsed.http_version : HTTP/2.0 | └ create evt.Parsed.remote_addr : 45.82.64.192 | └ create evt.Parsed.request_length : 1002 | └ create evt.Parsed.time_local : 02/Sep/2025:08:27:15 +0000 | └ create evt.Parsed.verb : GET | └ create evt.Parsed.port : - | └ create evt.Parsed.proxy_upstream_name : site-online-ithaca-production-3000 | └ update evt.StrTime : -> 2025-09-02T08:27:15+00:00 | └ create evt.Meta.http_path : /discounts?_rsc=1omfx | └ create evt.Meta.http_status : 200 | └ create evt.Meta.http_verb : GET | └ create evt.Meta.service : http | └ create evt.Meta.source_ip : 45.82.64.192 | └ create evt.Meta.target_fqdn : new.site.online | └ create evt.Meta.http_user_agent : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | └ create evt.Meta.log_type : http_access-log ├ s02-enrich | ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2) | ├ create evt.Enriched.MarshaledTime : 2025-09-02T08:27:15Z | ├ update evt.Time : 2025-09-02 09:32:29.405751013 +0000 UTC -> 2025-09-02 08:27:15 +0000 UTC | ├ update evt.MarshaledTime : -> 2025-09-02T08:27:15Z | ├ create evt.Meta.timestamp : 2025-09-02T08:27:15Z | ├ 🟢 crowdsecurity/geoip-enrich (+13) | ├ create evt.Enriched.ASNNumber : 49981 | ├ create evt.Enriched.ASNumber : 49981 | ├ create evt.Enriched.IsInEU : true | ├ create evt.Enriched.Latitude : 51.996800 | ├ create evt.Enriched.ASNOrg : WorldStream B.V. | ├ create evt.Enriched.IsoCode : NL | ├ create evt.Enriched.Longitude : 4.205700 | ├ create evt.Enriched.SourceRange : 45.82.64.0/22 | ├ create evt.Meta.ASNNumber : 49981 | ├ create evt.Meta.IsoCode : NL | ├ create evt.Meta.ASNOrg : WorldStream B.V. | ├ create evt.Meta.IsInEU : true | ├ create evt.Meta.SourceRange : 45.82.64.0/22 | ├ 🟢 crowdsecurity/http-logs (+8 ~1) | ├ update evt.Parsed.request : /discounts?_rsc=1omfx -> /discounts | ├ create evt.Parsed.file_frag : discounts | ├ create evt.Parsed.file_name : discounts | ├ create evt.Parsed.impact_completion : true | ├ create evt.Parsed.file_ext :  | ├ create evt.Parsed.http_args : _rsc=1omfx | ├ create evt.Parsed.static_ressource : false | ├ create evt.Parsed.file_dir : / | ├ create evt.Meta.http_args_len : 10 | ├ 🟢 crowdsecurity/public-dns-allowlist (unchanged) | └ 🟢 crowdsecurity/whitelists (unchanged) ├-------- parser success 🟢 ├ Scenarios └ 🟢 crowdsecurity/http-crawl-non_statics