Add new log sources

info

We will add a file-based acquisition. If you need a different source, adjust the instructions to match your setup.

Once you have identified the service you want to add, use cscli to install its collection.

tip

You can view the available collections on the Hub.

Linux/Freebsd

SH

cscli collections add <collection_name>

Windows

SH

cscli.exe collections add <collection_name>

Kubernetes

YAML

# In your values.yml file
agent:
env:
  - name: COLLECTIONS
    value: '<collection_name>'

Once the collection is downloaded, add a new Acquisition so CrowdSec knows where to find the log source.

info

Each collection on the Hub includes an example Acquisition, which helps you identify files to monitor and labels to assign.

info

Since version 1.5.0, you can add acquisitions via the acquis.d directory, which avoids editing the main configuration file.

Create the directory if it does not exist

Linux/Freebsd

SH

sudo mkdir -p /etc/crowdsec/acquis.d

Windows

Powershell

SH

New-Item -ItemType Directory -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\

CMD

SH

mkdir C:\ProgramData\CrowdSec\Config\acquis.d\

Create the acquisition file

Linux/Freebsd

SH

sudo touch /etc/crowdsec/acquis.d/<collection_name>.yaml

Windows

Powershell

SH

New-Item -ItemType File -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml

CMD

SH

.>C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml 2>NUL

Kubernetes

YAML

# In your values.yml file
agent:
# -- To add custom acquisitions using available datasources (https://docs.crowdsec.net/docs/next/log_processor/data_sources/intro)
additionalAcquisition:
  - source: file
    filenames:
      - '/path/to/your/file.log' ## Single file
      - '/path/to/your/files*' ## Wildcard support
    labels:
      type: '<type of logs>' ## Type defined in the parser

info

You can skip the following step if you are on Kubernetes.

Add the following contents to the file

<collection_name>.yaml

YAML<collection_name>.yaml

filenames:
  - "/path/to/your/file.log" ## Single file
  - "/path/to/your/files*" ## Wildcard support
labels:
  type: "<type of logs>" ## Type defined in the parser

Once you have added the acquisitions, test the configuration and restart the service.

Linux/Freebsd

SH

sudo crowdsec -t && sudo systemctl restart crowdsec

Windows

Powershell

SH

Restart-Service crowdsec

CMD

SH

net stop crowdsec && net start crowdsec

Kubernetes

SH

helm upgrade -f values.yaml crowdsec crowdsecurity/crowdsec

Next steps

Now that you have added a new acquisition, verify that logs are being parsed correctly. See Are the detected log sources working correctly?.