feat(nginx): 新增请求速率限制

apps/infra/monitor/crowdsec/helmchart.yaml

@@ -33,7 +33,7 @@ spec:
             type: nginx         
       env:
         - name: COLLECTIONS
-          value: "crowdsecurity/base-http-scenarios"
+          value: "crowdsecurity/base-http-scenarios crowdsecurity/http-dos"
         - name: SCENARIOS
           value: "crowdsecurity/nginx-req-limit-exceeded"
       persistentVolume:
@@ -86,41 +86,47 @@ spec:
               # nginx access logs
               - filter: TrimSpace(evt.Parsed.message) startsWith "{" && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "nginx") in ["", nil]
                 statics:
+                  - meta: service
+                    value: http
                   - meta: log_type
                     value: http_access-log
                   - target: evt.StrTime
-                    expression: evt.Parsed.time
-                  - meta: service
-                    value: http
+                    expression: evt.Unmarshaled.nginx.time_local
                   - meta: source_ip
                     expression: evt.Unmarshaled.nginx.remote_addr
                   - meta: http_status
                     expression: evt.Unmarshaled.nginx.status
                   - meta: http_path
-                    expression: evt.Unmarshaled.nginx.request
+                    expression: evt.Unmarshaled.nginx.request_uri
+                  - meta: http_verb
+                    expression: evt.Unmarshaled.nginx.request_method
                   - meta: http_user_agent
                     expression: evt.Unmarshaled.nginx.http_user_agent
+                  - meta: target_fqdn
+                    expression: evt.Unmarshaled.nginx.server_name
               # nginx error logs
               - grok:
                   pattern: '(%{IPORHOST:target_fqdn} )?%{NGINXERRTIME:time} \[%{LOGLEVEL:loglevel}\] %{NONNEGINT:pid}#%{NONNEGINT:tid}: (\*%{NONNEGINT:cid} )?%{GREEDYDATA:message}, client: %{IPORHOST:remote_addr}, server: %{DATA:target_fqdn}, request: "%{WORD:verb} ([^/]+)?%{NGCUSTOMURIPATHPARAM:request}( HTTP/%{NUMBER:http_version})?", host: "%{IPORHOST}(:%{NONNEGINT})?"'
                   apply_on: message
                   statics:
+                    - meta: service
+                      value: http
                     - meta: log_type
                       value: http_error-log
                     - target: evt.StrTime
                       expression: evt.Parsed.time
-                    - meta: service
-                      value: http
                     - meta: source_ip
-                      expression: "evt.Parsed.remote_addr"
+                      expression: evt.Parsed.remote_addr
                     - meta: http_status
-                      expression: "evt.Parsed.status"
+                      expression: evt.Parsed.status
                     - meta: http_path
-                      expression: "evt.Parsed.request"
+                      expression: evt.Parsed.request
+                    - meta: http_verb
+                      expression: evt.Parsed.verb
                     - meta: http_user_agent
-                      expression: "evt.Parsed.http_user_agent"
+                      expression: evt.Parsed.http_user_agent
                     - meta: target_fqdn
-                      expression: "evt.Parsed.target_fqdn"
+                      expression: evt.Parsed.target_fqdn
                 pattern_syntax:
                   NO_DOUBLE_QUOTE: '[^"]+'
                 onsuccess: next_stage