scl: add qbittorrent() and pihole-ftl() sources

news/feature-4760-1.md

@@ -0,0 +1,18 @@
+`pihole-ftl()`: Added a new source, which reads Pi-hole FTL logs.
+
+The FTL (Faster Than Light) logs are the logs which can be found
+in the "Tools" / "Pi-hole diagnosis" menu.
+
+Example minimal config:
+```
+source s_pihole_ftl {
+  pihole-ftl();
+};
+```
+
+By default it reads the `/var/log/pihole/FTL.log` file.
+You can change the root dir of Pi-hole's logs with the `dir()` option,
+where the `FTL.log` file can be found.
+
+As the `pihole-ftl()` source is based on a `file()` source, all of the
+`file()` source options are applicable, too.

news/feature-4760-2.md

@@ -0,0 +1,16 @@
+`qbittorrent()`: Added a new source, which reads qBittorrent logs.
+
+Example minimal config:
+```
+source s_qbittorrent {
+  qbittorrent(
+    dir("/path/to/my/qbittorrent/root/log/dir")
+  );
+};
+```
+
+The root dir of the qBittorrent logs can be found in the
+"Tools" / "Preferences" / "Behavior" / "Log file" / "Save path" field.
+
+As the `qbittorrent()` source is based on a `file()` source, all of the `file()`
+source options are applicable, too.

scl/CMakeLists.txt

@@ -31,8 +31,10 @@ set(SCL_DIRS
     osquery
     pacct
     paloalto
+    pihole
     pgsql
     python
+    qbittorrent
     rewrite
     slack
     snmptrap

scl/Makefile.am

@@ -31,8 +31,10 @@ SCL_SUBDIRS	= \
 	osquery	\
 	pacct		\
 	paloalto 	\
+	pihole		\
 	pgsql 	\
 	python		\
+	qbittorrent	\
 	rewrite	\
 	slack \
 	snmptrap	\

scl/pihole/pihole.conf

@@ -0,0 +1,66 @@
+#############################################################################
+# Copyright (c) 2023 Attila Szakacs
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 as published
+# by the Free Software Foundation, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+#
+# As an additional exemption you are allowed to compile & link against the
+# OpenSSL libraries as published by the OpenSSL project. See the file
+# COPYING for details.
+#
+#############################################################################
+
+block parser pihole_ftl()
+{
+  channel {
+    parser {
+      regexp-parser(
+        patterns('^\[([^ ]+ [^ ]+) [^ \]]+\] (FATAL:|ERR:|ERROR:|Error:|WARN:|WARNING:|Warning:|Notice:|INFO:|DEBUG:|) ?(?<MESSAGE>.*)')
+      );
+      date-parser(
+        template("$1")
+        format("%Y-%m-%d %H:%M:%S.%f")
+      );
+    };
+
+    rewrite {
+      set("Pi-hole" value("APP"));
+    };
+
+    if ("$2" eq "") {
+      # No severity was found.
+    } elif (match("FATAL" value("2"))) {
+      rewrite { set-severity("emergency"); };
+    } elif (match("^(ERR|ERROR|Error):$" value("2"))) {
+      rewrite { set-severity("error"); };
+    } elif (match("^(WARN|WARNING|Warning):$" value("2"))) {
+      rewrite { set-severity("warning"); };
+    } elif (match("^(Notice):$" value("2"))) {
+      rewrite { set-severity("notice"); };
+    } elif (match("^(INFO):$" value("2"))) {
+      rewrite { set-severity("info"); };
+    } elif (match("^(DEBUG):$" value("2"))) {
+      rewrite { set-severity("debug"); };
+    } else {};
+  };
+};
+
+block source pihole_ftl(
+  dir("/var/log/pihole")
+  ...)
+{
+  channel {
+    source { file("`dir`/FTL.log" flags(no-parse) `__VARARGS__`); };
+    parser { pihole_ftl(); };
+  };
+};

scl/qbittorrent/qbittorrent.conf

@@ -0,0 +1,60 @@
+#############################################################################
+# Copyright (c) 2023 Attila Szakacs
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 as published
+# by the Free Software Foundation, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+#
+# As an additional exemption you are allowed to compile & link against the
+# OpenSSL libraries as published by the OpenSSL project. See the file
+# COPYING for details.
+#
+#############################################################################
+
+block parser qbittorrent()
+{
+  channel {
+    parser {
+      regexp-parser(
+        patterns('^\((.)\) ([^ ]+) - (?<MESSAGE>.*)')
+      );
+      date-parser(
+        template("$2")
+        format("%Y-%m-%dT%H:%M:%S")
+      );
+    };
+
+    rewrite {
+      set("qBittorrent" value("APP"));
+    };
+
+    if (match("C" value("1") type("string"))) {
+      rewrite { set-severity("critical"); };
+    } elif (match("W" value("1") type("string"))) {
+      rewrite { set-severity("warning"); };
+    } elif (match("I" value("1") type("string"))) {
+      rewrite { set-severity("info"); };
+    } elif (match("N" value("1") type("string"))) {
+      rewrite { set-severity("notice"); };
+    } else {};
+  };
+};
+
+block source qbittorrent(
+  dir()
+  ...)
+{
+  channel {
+    source { file("`dir`/qbittorrent.log" flags(no-parse) `__VARARGS__`); };
+    parser { qbittorrent(); };
+  };
+};

tests/copyright/policy

@@ -210,6 +210,8 @@ scl/splunk/splunk\.conf$
 scl/google/google-pubsub\.conf$
 scl/openobserve/.*\.conf$
 scl/pgsql/pgsql\.conf$
+scl/qbittorrent/qbittorrent\.conf$
+scl/pihole/pihole\.conf$
 modules/python-modules/syslogng/modules/kubernetes/.*
 modules/ebpf/.*
 modules/python-modules/syslogng/modules/hypr/.*