badsmoke/logsense2loki repository overview

GIT Repo⁠

⁠LogSense2Loki

LogSense2Loki is a sophisticated Python-based solution designed for modern logging infrastructures. It captures syslog messages, intelligently parses them into JSON format, and efficiently forwards them to Grafana Loki. With optional GeoIP lookup capabilities, LogSense2Loki enhances your logs with geolocation data, providing invaluable insights for monitoring and analysis. Additionally, it exposes Prometheus metrics to ensure you can effortlessly track the performance of your logging setup.

just kidding,

it's probably not very performant, but it does what it's supposed to as long as OPNsense itself doesn't log json, it's definitely the best way.

With JSON it is very easy to search and analyze the logs, and especially to visualize them with Loki in Grafana.

It is quite simple so that you can easily add additional parsers, metrics endpoint gives information about how many percent could be parsed, for me it is 99.99%

⁠Features

• Syslog Capture and Parsing: Seamlessly capture syslog messages and parse them into a structured JSON format.
• Loki Integration: Effortlessly forward parsed logs to Grafana Loki for advanced log querying and visualization.
• GeoIP Lookup: Optional GeoIP lookup for public IP addresses, enhancing logs with city and country information (the geoip database can be easily integrated via maxmind.com).
• Prometheus Metrics: Exposes crucial Prometheus metrics to track successful and failed log parsing and transmission activities.

⁠Prometheus Metrics

LogSense2Loki provides the following Prometheus metrics endpoint at http://localhost:8100/metrics:

• logsense2loki_successful_logs_total: Monitors the total number of successfully parsed and sent logs.
• logsense2loki_failed_logs_total: Tracks the total number of logs that failed to parse or send.

⁠Configuration

⁠OPNsense configuration

System -> Settings -> Logging -> Remote -> "+"

⁠Environment Variables

Configure LogSense2Loki using the following environment variables:

• SYSLOG_HOST: The syslog server host (default: 0.0.0.0)
• SYSLOG_PORT: The syslog server port (default: 1540)
• LOKI_URL: The Grafana Loki URL (default: https://logs.domain.com/api/prom/push)
• GEOIP_DB_PATH: Path to the MaxMind GeoIP database (default: /geo/db/GeoLite2-City.mmdb)
• ENABLE_GEOIP: Enable (True) or disable (False) GeoIP lookups (default: False)

⁠Sample Configuration File (config.py)

SYSLOG_HOST = '0.0.0.0'
SYSLOG_PORT = 1540
LOKI_URL = 'https://logs.domain.com/api/prom/push'
GEOIP_DB_PATH = "/geo/db/GeoLite2-City.mmdb"
ENABLE_GEOIP = False

⁠Running LogSense2Loki with Docker

⁠Docker Compose Configuration

Here is a sample docker-compose.yml to get you started:

version: "2"
services:
  LogSense2Loki:
    image: badsmoke/logsense2loki
    ports:
      - 1540:1540
      - 8100:8100
    restart: always
    volumes:
      - ./geodb/:/geodb/
    environment:
      - SYSLOG_HOST=0.0.0.0
      - SYSLOG_PORT=1540
      - LOKI_URL=https://logs.domain.com/api/prom/push
      - GEOIP_DB_PATH=/geo/db/GeoLite2-City.mmdb
      - ENABLE_GEOIP=False

To run LogSense2Loki with the above configuration, use:

docker-compose up -d

⁠Building the Docker Image

Build the Docker image with the following command:

docker build -t logsense2loki .

⁠Grafana Geomap Integration

To visualize the GeoIP data in Grafana Geomap, follow these steps:

1. Configure Data Source: Ensure your Loki data source is configured in Grafana.

2. Create a New Dashboard: Add a new panel using the Geomap plugin.

3. Data Query: Use a query that extracts the relevant GeoIP information. Example query:

   {service="geoip"} |= "latitude" |= "longitude" 
   

   Copy

   

   

4. Styling and Visualization: Customize the appearance of your Geomap panel to suit your needs.

⁠Conclusion

LogSense2Loki brings structure, insight, and performance to your logging infrastructure. With its powerful parsing, forwarding, GeoIP, and metric capabilities, it's an indispensable tool for any modern monitoring ecosystem.

⁠todo's

• add geoip?
• check filterlog block/pass in/out
• add kernel parser
• add other endpoints

⁠License

This project is licensed under the MIT License.