byrsapty
510ca37e48
- Two flood-detection alerts (per-source message volume, calibrated live against real traffic) grouped by gl2_remote_ip - Session correlation: accelppp_interface fallback tagging plus radius_session_id/calling_station_id/radius_username extraction, so a subscriber's full session lifecycle is searchable by one key - Replace the single combined dashboard with three focused ones (Overview & Alerts, Network Equipment, Servers & Sessions) - Propagate GRAYLOG_ROOT_TIMEZONE and IP-in-alerts fixes into the reusable install script and templates - Add a Forgejo Actions workflow (manual trigger) that re-runs install-graylog.sh on a self-hosted runner living in the container, automating the deploy step this project has done by hand all along Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
78 lines
3 KiB
JSON
78 lines
3 KiB
JSON
{
|
|
"queries": [
|
|
{
|
|
"id": "a2000000-0000-0000-0000-000000000001",
|
|
"timerange": {"type": "relative", "range": 604800},
|
|
"filter": null,
|
|
"filters": [],
|
|
"query": {"type": "elasticsearch", "query_string": ""},
|
|
"search_types": [
|
|
{
|
|
"id": "a2000000-0000-0000-0000-000000000011",
|
|
"type": "pivot",
|
|
"name": "chart",
|
|
"timerange": {"type": "relative", "range": 604800},
|
|
"query": null,
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"stream_categories": [],
|
|
"series": [{"type": "count", "id": "Message count", "field": null}],
|
|
"sort": [],
|
|
"rollup": false,
|
|
"row_groups": [{"type": "time", "fields": ["timestamp"], "interval": {"type": "auto", "scaling": 1.0}}],
|
|
"column_groups": [{"type": "values", "fields": ["event_type"], "limit": 10, "skip_empty_values": false}],
|
|
"filter": null,
|
|
"filters": []
|
|
},
|
|
{
|
|
"id": "a2000000-0000-0000-0000-000000000012",
|
|
"type": "pivot",
|
|
"name": "chart",
|
|
"timerange": {"type": "relative", "range": 604800},
|
|
"query": null,
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"stream_categories": [],
|
|
"series": [{"type": "count", "id": "Message count", "field": null}],
|
|
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
|
|
"rollup": true,
|
|
"row_groups": [{"type": "values", "fields": ["vendor"], "limit": 10, "skip_empty_values": true}],
|
|
"column_groups": [],
|
|
"filter": null,
|
|
"filters": []
|
|
},
|
|
{
|
|
"id": "a2000000-0000-0000-0000-000000000013",
|
|
"type": "pivot",
|
|
"name": "chart",
|
|
"timerange": {"type": "relative", "range": 604800},
|
|
"query": null,
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"stream_categories": [],
|
|
"series": [{"type": "count", "id": "Message count", "field": null}],
|
|
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
|
|
"rollup": true,
|
|
"row_groups": [{"type": "values", "fields": ["event_type"], "limit": 15, "skip_empty_values": true}],
|
|
"column_groups": [],
|
|
"filter": null,
|
|
"filters": []
|
|
},
|
|
{
|
|
"id": "a2000000-0000-0000-0000-000000000014",
|
|
"type": "pivot",
|
|
"name": "chart",
|
|
"timerange": {"type": "relative", "range": 604800},
|
|
"query": null,
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"stream_categories": [],
|
|
"series": [{"type": "count", "id": "Message count", "field": null}],
|
|
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
|
|
"rollup": true,
|
|
"row_groups": [{"type": "values", "fields": ["source"], "limit": 15, "skip_empty_values": true}],
|
|
"column_groups": [],
|
|
"filter": null,
|
|
"filters": []
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"parameters": []
|
|
}
|