line: Oct 15 19:36:04 pop dovecot[3388]: auth-worker(3398): conn unix:auth-worker (uid=143): auth-worker<41568>: ldap(delinm@free.de,125.136.25.109,<ph+zYYck2uB9iBlt>): unknown user
	├ s00-raw
	|	└ 🟢 crowdsecurity/syslog-logs (+12 ~9)
	|		└ update evt.ExpectMode : %!s(int=0) -> 1
	|		└ update evt.Stage :  -> s01-parse
	|		└ update evt.Line.Raw :  -> Oct 15 19:36:04 pop dovecot[3388]: auth-worker(3398): conn unix:auth-worker (uid=143): auth-worker<41568>: ldap(delinm@free.de,125.136.25.109,<ph+zYYck2uB9iBlt>): unknown user
	|		└ update evt.Line.Src :  -> /tmp/cscli_explain3736155185/cscli_test_tmp.log
	|		└ update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2024-10-15 21:18:40.761015972 +0000 UTC
	|		└ create evt.Line.Labels.type : syslog
	|		└ update evt.Line.Process : %!s(bool=false) -> true
	|		└ update evt.Line.Module :  -> file
	|		└ create evt.Parsed.message : auth-worker(3398): conn unix:auth-worker (uid=143): auth-worker<41568>: ldap(delinm@free.de,125.136.25.109,<ph+zYYck2uB9iBlt>): unknown user
	|		└ create evt.Parsed.pid : 3388
	|		└ create evt.Parsed.priority : 
	|		└ create evt.Parsed.program : dovecot
	|		└ create evt.Parsed.timestamp : Oct 15 19:36:04
	|		└ create evt.Parsed.timestamp8601 : 
	|		└ create evt.Parsed.facility : 
	|		└ create evt.Parsed.logsource : syslog
	|		└ update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2024-10-15 21:18:40.761210829 +0000 UTC
	|		└ update evt.StrTime :  -> Oct 15 19:36:04
	|		└ create evt.Meta.datasource_path : /tmp/cscli_explain3736155185/cscli_test_tmp.log
	|		└ create evt.Meta.datasource_type : file
	|		└ create evt.Meta.machine : pop
	├ s01-parse
	|	├ 🔴 crowdsecurity/dovecot-logs
	|	├ 🔴 crowdsecurity/postscreen-logs
	|	└ 🔴 crowdsecurity/sshd-logs
	└-------- parser failure 🔴