Add new log sources

We will add a file-based acquisition. If you need a different source, adjust the instructions to match your setup.

Once you have identified the service you want to add, use cscli to install its collection.

You can view the available collections on the Hub.

Linux/Freebsd

cscli collections add <collection_name>

Windows

cscli.exe collections add <collection_name>

Kubernetes

# In your values.yml file
agent:
env:
  - name: COLLECTIONS
    value: '<collection_name>'

Once the collection is downloaded, add a new Acquisition so CrowdSec knows where to find the log source.

Each collection on the Hub includes an example Acquisition, which helps you identify files to monitor and labels to assign.

Since version 1.5.0, you can add acquisitions via the acquis.d directory, which avoids editing the main configuration file.

Create the directory if it does not exist

Linux/Freebsd

sudo mkdir -p /etc/crowdsec/acquis.d

Windows

Powershell

New-Item -ItemType Directory -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\

CMD

mkdir C:\ProgramData\CrowdSec\Config\acquis.d\

Create the acquisition file

Linux/Freebsd

sudo touch /etc/crowdsec/acquis.d/<collection_name>.yaml

Windows

Powershell

New-Item -ItemType File -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml

CMD

.>C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml 2>NUL

Kubernetes

# In your values.yml file
agent:
# -- To add custom acquisitions using available datasources (https://docs.crowdsec.net/docs/next/log_processor/data_sources/intro)
additionalAcquisition:
  - source: file
    filenames:
      - '/path/to/your/file.log' ## Single file
      - '/path/to/your/files*' ## Wildcard support
    labels:
      type: '<type of logs>' ## Type defined in the parser

You can skip the following step if you are on Kubernetes.

Add the following contents to the file

<collection_name>.yaml

filenames:
  - "/path/to/your/file.log" ## Single file
  - "/path/to/your/files*" ## Wildcard support
labels:
  type: "<type of logs>" ## Type defined in the parser

Once you have added the acquisitions, test the configuration and restart the service.

Linux/Freebsd

sudo crowdsec -t && sudo systemctl restart crowdsec

Windows

Powershell

Restart-Service crowdsec

CMD

net stop crowdsec && net start crowdsec

Kubernetes

helm upgrade -f values.yaml crowdsec crowdsecurity/crowdsec

Next steps

Now that you have added a new acquisition, verify that logs are being parsed correctly. See Are the detected log sources working correctly?.