Fail2Ban configuration for Grafana's Loki promtail

config.yaml

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /data/positions.yaml

clients:
  - url: ${LOKI_HOST}/loki/api/v1/push
    basic_auth:
      username: ${LOKI_USERNAME}
      password: ${LOKI_PASSWORD}

scrape_configs:
- job_name: fail2ban
  static_configs:
    - targets:
      - localhost
      labels:
        __path__: /var/log/fail2ban.log
        job: fail2ban
        nodename: ${HOSTNAME}
  pipeline_stages:
    - multiline:
        firstline: '\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}'
    - regex:
        expression: >-
          ^(?s)(?P<time>\S+? \S+?)
          (fail2ban\.)(?P<component>\S+)\s*
          \[(?P<pid>\S+)\]:
          (?P<priority>\S+)\s*
          (?P<message>.*?)$
    - timestamp:
        source: time
        format: '2006-01-02 15:04:05,000'
    - labels:
        component:
        priority:
    - output:
        source: message
    # Extract jail from message, if present
    - match:
        # Note: backticks do not work in promtail, so weird escaping is needed
        selector: '{job="fail2ban"} |~ "\\\\[\\\\S+\\\\] .*"'
        stages:
          - regex:
              expression: '(\[(?P<jail>\S+)\] )?(?P<message>.*?)$'
          - labels:
              jail:
          - output:
              source: message
    - labeldrop:
        - filename

docker-compose.yml

version: "3.2"

services:
  promtail:
    restart: unless-stopped
    image: grafana/promtail
    container_name: promtail
    network_mode: host
    environment:
      LOKI_HOST: ${LOKI_HOST}
      LOKI_USERNAME: ${LOKI_USERNAME}
      LOKI_PASSWORD: ${LOKI_PASSWORD}
    volumes:
      - ./config.yaml:/etc/promtail/config.yml
      - promtail:/data
      - /var/log:/var/log:ro
    command:
      - -config.file=/etc/promtail/config.yml
      - -config.expand-env=true

volumes:
  promtail:

grafana-dashboard.json

{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": 20,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "datasource": {
        "type": "loki",
        "uid": "GJCWu4jMk"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 10,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "linear",
            "lineStyle": {
              "fill": "solid"
            },
            "lineWidth": 1,
            "pointSize": 3,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "normal"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "min": 0,
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 0
      },
      "id": 2,
      "interval": "15m",
      "options": {
        "legend": {
          "calcs": [],
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi",
          "sort": "none"
        }
      },
      "pluginVersion": "8.4.4",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "GJCWu4jMk"
          },
          "expr": "sum by (nodename) (count_over_time({job=\"fail2ban\",component=\"actions\"} |~ \"Ban .*\" [$__interval]))",
          "legendFormat": "{{ nodename }}",
          "refId": "A"
        }
      ],
      "title": "Bans per 15m",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "GJCWu4jMk"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 0,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "linear",
            "lineWidth": 1,
            "pointSize": 3,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "min": 0,
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 0
      },
      "id": 7,
      "interval": "15m",
      "options": {
        "legend": {
          "calcs": [],
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "GJCWu4jMk"
          },
          "expr": "sum by (nodename, component) (count_over_time({job=\"fail2ban\",priority=\"ERROR\"} [$__interval]))",
          "legendFormat": "{{ nodename }}: {{component}}",
          "refId": "A"
        }
      ],
      "title": "Errors per 15m",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "GJCWu4jMk"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 10,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "linear",
            "lineStyle": {
              "fill": "solid"
            },
            "lineWidth": 1,
            "pointSize": 3,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "normal"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "min": 0,
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 8
      },
      "id": 3,
      "interval": "15m",
      "options": {
        "legend": {
          "calcs": [],
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi",
          "sort": "none"
        }
      },
      "pluginVersion": "8.4.4",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "GJCWu4jMk"
          },
          "expr": "sum by (nodename) (count_over_time({job=\"fail2ban\",component=\"actions\"} |~ \"Unban .*\" [$__interval]))",
          "legendFormat": "{{ nodename }}",
          "refId": "A"
        }
      ],
      "title": "Unbans per 15m",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "GJCWu4jMk"
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 8
      },
      "id": 5,
      "options": {
        "dedupStrategy": "none",
        "enableLogDetails": true,
        "prettifyLogMessage": false,
        "showCommonLabels": false,
        "showLabels": true,
        "showTime": true,
        "sortOrder": "Descending",
        "wrapLogMessage": false
      },
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "GJCWu4jMk"
          },
          "expr": "{job=\"fail2ban\",priority=\"ERROR\"}",
          "maxLines": 100,
          "refId": "A"
        }
      ],
      "title": "Error logs",
      "type": "logs"
    }
  ],
  "schemaVersion": 35,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Fail2Ban",
  "uid": "47Lk3fP7z",
  "version": 3,
  "weekStart": ""
}