Settings — Parsing & Enrichment

Parsing & Enrichment

%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}

if ip in blocklist then tag: ["suspicious","blocklist-hit"]