103 lines
2.3 KiB
Django/Jinja
103 lines
2.3 KiB
Django/Jinja
loki.relabel "journal" {
|
|
forward_to = []
|
|
|
|
rule {
|
|
source_labels = ["__journal__systemd_unit"]
|
|
target_label = "unit"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__journal_priority_keyword"]
|
|
target_label = "level"
|
|
}
|
|
}
|
|
|
|
loki.source.journal "system" {
|
|
forward_to = [loki.process.journal.receiver]
|
|
relabel_rules = loki.relabel.journal.rules
|
|
labels = {
|
|
job = "systemd-journal",
|
|
host = "ingress",
|
|
}
|
|
}
|
|
|
|
loki.process "journal" {
|
|
forward_to = [loki.write.default.receiver]
|
|
|
|
stage.match {
|
|
selector = `{job="systemd-journal"} |~ "\\[UFW AUDIT\\]"`
|
|
action = "drop"
|
|
}
|
|
|
|
stage.match {
|
|
selector = `{job="systemd-journal"} |~ "\\[UFW BLOCK\\]"`
|
|
|
|
stage.regex {
|
|
expression = `\[UFW\s(?P<action>\w+)\].*?SRC=(?P<ip>[0-9.]+).*?DST=(?P<dst>[0-9.]+).*?PROTO=(?P<proto>\w+)(?:\sSPT=(?P<spt>\d+))?(?:\sDPT=(?P<dpt>\d+))?`
|
|
}
|
|
|
|
stage.geoip {
|
|
db = "/opt/database/GeoLite2-City.mmdb"
|
|
source = "ip"
|
|
db_type = "city"
|
|
}
|
|
|
|
stage.labels {
|
|
values = {
|
|
action = "",
|
|
proto = "",
|
|
dpt = "",
|
|
geoip_country_name = "",
|
|
geoip_country_code = "",
|
|
geoip_location_latitude = "",
|
|
geoip_location_longitude = "",
|
|
}
|
|
}
|
|
|
|
stage.static_labels {
|
|
values = {
|
|
job = "ufw",
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
local.file_match "fail2ban" {
|
|
path_targets = [{"__path__" = "/var/log/fail2ban.log", job = "fail2ban", host = "ingress"}]
|
|
}
|
|
|
|
loki.source.file "fail2ban_source" {
|
|
targets = local.file_match.fail2ban.targets
|
|
forward_to = [loki.process.fail2ban.receiver]
|
|
}
|
|
|
|
loki.process "fail2ban" {
|
|
forward_to = [loki.write.default.receiver]
|
|
|
|
stage.regex {
|
|
expression = `^.*:\s(?<level>\w*)\s*\[(?<service>\w*)\]\s(?<type>\w*)\s(?<ip>(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))).*$`
|
|
labels_from_groups = true
|
|
}
|
|
|
|
stage.geoip {
|
|
db = "/opt/database/GeoLite2-City.mmdb"
|
|
source = "ip"
|
|
db_type = "city"
|
|
}
|
|
|
|
stage.labels {
|
|
values = {
|
|
geoip_country_name = "",
|
|
geoip_country_code = "",
|
|
geoip_location_latitude = "",
|
|
geoip_location_longitude = "",
|
|
}
|
|
}
|
|
}
|
|
|
|
loki.write "default" {
|
|
endpoint {
|
|
url = "http://{{ wireguard_beepi_ip }}:3100/loki/api/v1/push"
|
|
}
|
|
}
|