byrsapty
510ca37e48
- Two flood-detection alerts (per-source message volume, calibrated live against real traffic) grouped by gl2_remote_ip - Session correlation: accelppp_interface fallback tagging plus radius_session_id/calling_station_id/radius_username extraction, so a subscriber's full session lifecycle is searchable by one key - Replace the single combined dashboard with three focused ones (Overview & Alerts, Network Equipment, Servers & Sessions) - Propagate GRAYLOG_ROOT_TIMEZONE and IP-in-alerts fixes into the reusable install script and templates - Add a Forgejo Actions workflow (manual trigger) that re-runs install-graylog.sh on a self-hosted runner living in the container, automating the deploy step this project has done by hand all along Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
139 lines
5.8 KiB
JSON
139 lines
5.8 KiB
JSON
{
|
|
"entity": {
|
|
"type": "DASHBOARD",
|
|
"title": "Overview & Alerts",
|
|
"summary": "Landing dashboard - what's firing right now and overall message volume.",
|
|
"description": "Start here. Recent alerts, message volume by source (to catch floods), and a priority/critical breakdown for the last 24 hours.",
|
|
"search_id": "__SEARCH_ID__",
|
|
"properties": [],
|
|
"requires": {},
|
|
"state": {
|
|
"a1000000-0000-0000-0000-000000000001": {
|
|
"selected_fields": null,
|
|
"static_message_list_id": null,
|
|
"titles": {
|
|
"tab": {"title": "Overview"},
|
|
"widget": {
|
|
"a1000000-0000-0000-0000-000000000011": "Recent Alerts (24h)",
|
|
"a1000000-0000-0000-0000-000000000012": "Message Volume by Source (last hour)",
|
|
"a1000000-0000-0000-0000-000000000013": "Events by Priority (24h)",
|
|
"a1000000-0000-0000-0000-000000000014": "Critical Events by Type (24h)"
|
|
}
|
|
},
|
|
"widgets": [
|
|
{
|
|
"id": "a1000000-0000-0000-0000-000000000011",
|
|
"type": "messages",
|
|
"filter": null,
|
|
"filters": [],
|
|
"timerange": {"type": "relative", "range": 86400},
|
|
"query": null,
|
|
"streams": ["000000000000000000000002"],
|
|
"stream_categories": [],
|
|
"config": {
|
|
"fields": ["timestamp", "priority", "message"],
|
|
"show_message_row": true,
|
|
"decorators": [],
|
|
"sort": []
|
|
},
|
|
"description": null,
|
|
"context": null
|
|
},
|
|
{
|
|
"id": "a1000000-0000-0000-0000-000000000012",
|
|
"type": "aggregation",
|
|
"filter": null,
|
|
"filters": [],
|
|
"timerange": {"type": "relative", "range": 3600},
|
|
"query": null,
|
|
"streams": [],
|
|
"stream_categories": [],
|
|
"config": {
|
|
"row_pivots": [{"fields": ["timestamp"], "type": "time", "config": {"interval": {"type": "auto", "scaling": 1.0}}}],
|
|
"units": {},
|
|
"column_pivots": [{"fields": ["gl2_remote_ip"], "type": "values", "config": {"limit": 10}}],
|
|
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
|
|
"sort": [],
|
|
"visualization": "line",
|
|
"visualization_config": {"interpolation": "linear", "axis_type": "linear"},
|
|
"formatting_settings": null,
|
|
"rollup": false,
|
|
"event_annotation": false,
|
|
"row_limit": null,
|
|
"column_limit": 10
|
|
},
|
|
"description": null,
|
|
"context": null
|
|
},
|
|
{
|
|
"id": "a1000000-0000-0000-0000-000000000013",
|
|
"type": "aggregation",
|
|
"filter": null,
|
|
"filters": [],
|
|
"timerange": {"type": "relative", "range": 86400},
|
|
"query": null,
|
|
"streams": ["000000000000000000000002"],
|
|
"stream_categories": [],
|
|
"config": {
|
|
"row_pivots": [{"fields": ["priority"], "type": "values", "config": {"limit": 10}}],
|
|
"units": {},
|
|
"column_pivots": [],
|
|
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
|
|
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
|
|
"visualization": "pie",
|
|
"visualization_config": null,
|
|
"formatting_settings": null,
|
|
"rollup": true,
|
|
"event_annotation": false,
|
|
"row_limit": 10,
|
|
"column_limit": null
|
|
},
|
|
"description": null,
|
|
"context": null
|
|
},
|
|
{
|
|
"id": "a1000000-0000-0000-0000-000000000014",
|
|
"type": "aggregation",
|
|
"filter": null,
|
|
"filters": [],
|
|
"timerange": {"type": "relative", "range": 86400},
|
|
"query": "severity_tag:critical",
|
|
"streams": [],
|
|
"stream_categories": [],
|
|
"config": {
|
|
"row_pivots": [{"fields": ["event_type"], "type": "values", "config": {"limit": 15}}],
|
|
"units": {},
|
|
"column_pivots": [],
|
|
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
|
|
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
|
|
"visualization": "table",
|
|
"visualization_config": {"pinned_columns": [], "show_row_numbers": true},
|
|
"formatting_settings": null,
|
|
"rollup": true,
|
|
"event_annotation": false,
|
|
"row_limit": 15,
|
|
"column_limit": null
|
|
},
|
|
"description": null,
|
|
"context": null
|
|
}
|
|
],
|
|
"widget_mapping": {
|
|
"a1000000-0000-0000-0000-000000000011": ["a1000000-0000-0000-0000-000000000011"],
|
|
"a1000000-0000-0000-0000-000000000012": ["a1000000-0000-0000-0000-000000000012"],
|
|
"a1000000-0000-0000-0000-000000000013": ["a1000000-0000-0000-0000-000000000013"],
|
|
"a1000000-0000-0000-0000-000000000014": ["a1000000-0000-0000-0000-000000000014"]
|
|
},
|
|
"positions": {
|
|
"a1000000-0000-0000-0000-000000000011": {"col": 1, "row": 1, "height": 5, "width": "Infinity"},
|
|
"a1000000-0000-0000-0000-000000000012": {"col": 1, "row": 6, "height": 4, "width": "Infinity"},
|
|
"a1000000-0000-0000-0000-000000000013": {"col": 1, "row": 10, "height": 4, "width": 6},
|
|
"a1000000-0000-0000-0000-000000000014": {"col": 7, "row": 10, "height": 4, "width": 6}
|
|
},
|
|
"formatting": {"highlighting": []},
|
|
"display_mode_settings": {"positions": {}}
|
|
}
|
|
}
|
|
},
|
|
"share_request": {"selected_grantee_capabilities": {}}
|
|
}
|