Fix syslog from use + filtering

api/syslog.py

@@ -20,50 +20,46 @@ def receive_syslog():
                 return jsonify({'error': 'JSON data required'}), 400
             
             # Extract log messages from JSON
-            messages = data.get('messages', [])
-            if not messages:
-                # Single message
-                messages = [data.get('message', '')]
+            message = data.get('syslog_message', [])
+            if not message:
+                return jsonify({'error': 'syslog_message field required'}), 400
             
             processed_count = 0
             
-            for message in messages:
-                if not message:
-                    continue
                 
-                try:
-                    # Parse RFC 5424 message
-                    parsed = parse_rfc5424_log(message)
-                    
-                    # Create log entry
-                    log_entry = SystemLog(
-                        facility=parsed['facility'],
-                        severity=parsed['severity'],
-                        version=parsed['version'],
-                        timestamp=parsed['timestamp'],
-                        hostname=parsed['hostname'],
-                        app_name=parsed['app_name'],
-                        proc_id=parsed['proc_id'],
-                        msg_id=parsed['msg_id'],
-                        structured_data=parsed['structured_data'],
-                        message=parsed['message'],
-                        user_id=get_current_user_safe().id if get_current_user_safe() else None,
-                        source_ip=request.remote_addr,
-                        event_type='syslog_received'
-                    )
-                    
-                    db.session.add(log_entry)
-                    processed_count += 1
-                    
-                except Exception as e:
-                    # Log parsing error but continue processing
-                    log_event(
-                        severity=4,
-                        message=f"Failed to parse syslog message: {str(e)}",
-                        event_type="syslog_parse_error",
-                        user_id=get_current_user_safe().id if get_current_user_safe() else None
-                    )
-            
+            try:
+                # Parse RFC 5424 message
+                parsed = parse_rfc5424_log(message)
+                
+                # Create log entry
+                log_entry = SystemLog(
+                    facility=parsed['facility'],
+                    severity=parsed['severity'],
+                    version=parsed['version'],
+                    timestamp=parsed['timestamp'],
+                    hostname=parsed['hostname'],
+                    app_name=parsed['app_name'],
+                    proc_id=parsed['proc_id'],
+                    msg_id=parsed['msg_id'],
+                    structured_data=parsed['structured_data'],
+                    message=parsed['message'],
+                    user_id=get_current_user_safe().id if get_current_user_safe() else None,
+                    source_ip=request.remote_addr,
+                    event_type='syslog_received'
+                )
+                
+                db.session.add(log_entry)
+                processed_count += 1
+                
+            except Exception as e:
+                # Log parsing error but continue processing
+                log_event(
+                    severity=4,
+                    message=f"Failed to parse syslog message: {str(e)}",
+                    event_type="syslog_parse_error",
+                    user_id=get_current_user_safe().id if get_current_user_safe() else None
+                )
+        
             db.session.commit()
             
             return jsonify({

app.py

@@ -55,9 +55,11 @@ with app.app_context():
     from api.syslog import syslog_bp
     from web.routes import web_bp
     from api.webhooks import webhooks_bp
+    from web.events import events_bp
 
     app.register_blueprint(evidence_bp, url_prefix='/')
     app.register_blueprint(login_bp, url_prefix='/v1')
     app.register_blueprint(syslog_bp, url_prefix='/')
     app.register_blueprint(webhooks_bp, url_prefix='/api')
     app.register_blueprint(web_bp)
+    app.register_blueprint(events_bp)

templates/logs.html

@@ -48,13 +48,7 @@
                     <label for="eventTypeFilter" class="form-label">Event Type</label>
                     <select class="form-select" id="eventTypeFilter" name="event_type">
                         <option value="">All Events</option>
-                        <option value="login_success" {{ 'selected' if event_type_filter == 'login_success' }}>Login Success</option>
-                        <option value="login_failed" {{ 'selected' if event_type_filter == 'login_failed' }}>Login Failed</option>
-                        <option value="upload_started" {{ 'selected' if event_type_filter == 'upload_started' }}>Upload Started</option>
-                        <option value="upload_completed" {{ 'selected' if event_type_filter == 'upload_completed' }}>Upload Completed</option>
-                        <option value="attestation_created" {{ 'selected' if event_type_filter == 'attestation_created' }}>Attestation Created</option>
-                        <option value="download_url_generated" {{ 'selected' if event_type_filter == 'download_url_generated' }}>Download URL Generated</option>
-                        <option value="syslog_received" {{ 'selected' if event_type_filter == 'syslog_received' }}>Syslog Received</option>
+                        <!-- Event types will be loaded dynamically -->
                     </select>
                 </div>
                 <div class="col-md-4">
@@ -221,6 +215,7 @@ const severityLevels = {
 };
 
 document.addEventListener('DOMContentLoaded', function() {
+    loadEventTypes();
     loadLogs();
     loadLogStats();
     
@@ -237,6 +232,47 @@ document.addEventListener('DOMContentLoaded', function() {
     });
 });
 
+async function loadEventTypes() {
+    try {
+        const response = await axios.get('/ux/events/types', {
+            headers: {
+                'Authorization': `Bearer {{ session.get("access_token", "") }}`
+            }
+        });
+        
+        if (response.data.event_types) {
+            const select = document.getElementById('eventTypeFilter');
+            const currentValue = '{{ event_type_filter }}'; // Get selected value from template
+            
+            // Keep the "All Events" option
+            select.innerHTML = '<option value="">All Events</option>';
+            
+            // Add each event type as an option
+            response.data.event_types.forEach(eventType => {
+                const option = document.createElement('option');
+                option.value = eventType;
+                
+                // Convert event_type to a more readable format
+                const displayName = eventType
+                    .split('_')
+                    .map(word => word.charAt(0).toUpperCase() + word.slice(1))
+                    .join(' ');
+                
+                option.textContent = displayName;
+                
+                // Set as selected if it matches the current filter
+                if (eventType === currentValue) {
+                    option.selected = true;
+                }
+                
+                select.appendChild(option);
+            });
+        }
+    } catch (error) {
+        console.error('Failed to load event types:', error);
+    }
+}
+
 async function loadLogs(page = 1) {
     try {
         const params = new URLSearchParams({
@@ -467,7 +503,10 @@ function applyFilters() {
 }
 
 function refreshLogs() {
-    loadLogs(currentPage);
+    // Re-apply any existing filters
+    applyFilters();
+    
+    // Reload log statistics
     loadLogStats();
 }
 

web/events.py

@@ -0,0 +1,43 @@
+from flask import Blueprint, jsonify, session, request
+from models import SystemLog, db
+from logging_utils import log_event
+from web.routes import login_required, is_admin_user_web
+
+events_bp = Blueprint('events', __name__)
+
+@events_bp.route('/ux/events/types')
+@login_required
+def get_event_types():
+    """Get all unique event types for filtering"""
+    if 'user_id' not in session:
+        return jsonify({'error': 'Unauthorized'}), 401
+    
+    user_id = session['user_id']
+    is_admin = is_admin_user_web(user_id)
+    
+    try:
+        # Base query - get distinct event types
+        query = db.session.query(SystemLog.event_type).distinct()
+        
+        # Filter by user_id unless user is admin
+        if not is_admin:
+            query = query.filter(SystemLog.user_id == user_id)
+        
+        # Execute query and get all event types
+        event_types = [event_type[0] for event_type in query.all() if event_type[0] is not None]
+        
+        # Sort alphabetically
+        event_types.sort()
+        
+        return jsonify({
+            'event_types': event_types
+        })
+        
+    except Exception as e:
+        log_event(
+            severity=3,
+            message=f"Failed to get event types: {str(e)}",
+            event_type="get_event_types_error",
+            user_id=session.get('user_id')
+        )
+        return jsonify({'error': str(e)}), 500