{ "__inputs": [ { "name": "DS_LOKI", "label": "Loki", "description": "", "type": "datasource", "pluginId": "loki", "pluginName": "Loki" } ], "__requires": [ { "type": "grafana", "id": "grafana", "name": "Grafana", "version": "8.2.6" }, { "type": "panel", "id": "logs", "name": "Logs", "version": "" }, { "type": "datasource", "id": "loki", "name": "Loki", "version": "1.0.0" }, { "type": "panel", "id": "stat", "name": "Stat", "version": "" }, { "type": "panel", "id": "table", "name": "Table", "version": "" }, { "type": "panel", "id": "timeseries", "name": "Time series", "version": "" } ], "annotations": { "list": [ { "builtIn": 1, "datasource": "-- Grafana --", "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "target": { "limit": 100, "matchAny": false, "tags": [], "type": "dashboard" }, "type": "dashboard" } ] }, "editable": true, "fiscalYearStartMonth": 0, "gnetId": 15415, "graphTooltip": 0, "id": null, "iteration": 1647200710925, "links": [], "liveNow": false, "panels": [ { "collapsed": false, "datasource": null, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }, "id": 10, "panels": [], "title": "Frequency", "type": "row" }, { "datasource": "${DS_LOKI}", "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "bars", "fillOpacity": 0, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] }, "unit": "short" }, "overrides": [] }, "gridPos": { "h": 6, "w": 19, "x": 0, "y": 1 }, "id": 6, "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom" }, "tooltip": { "mode": "single" } }, "pluginVersion": "8.2.6", "targets": [ { "expr": "rate( ({job=\"$job\", identity=\"$identity\"} |~ \"$domain\" |~ \"$ip\" |~ \"$custom\")[5s] )", "hide": false, "instant": false, "legendFormat": "", "range": true, "refId": "B" } ], "title": "Frequency", "type": "timeseries" }, { "datasource": "${DS_LOKI}", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 6, "w": 3, "x": 19, "y": 1 }, "id": 4, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "text": {}, "textMode": "auto" }, "pluginVersion": "8.2.6", "targets": [ { "expr": "sum(count_over_time({job=\"$job\", identity=\"$identity\"} |= \"$domain\" |= \"$ip\" |= \"$custom\" [$__range]))", "instant": false, "range": true, "refId": "A" } ], "title": "Total Events", "type": "stat" }, { "collapsed": false, "datasource": null, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 7 }, "id": 12, "panels": [], "title": "Logs", "type": "row" }, { "datasource": "${DS_LOKI}", "gridPos": { "h": 17, "w": 22, "x": 0, "y": 8 }, "id": 2, "options": { "dedupStrategy": "none", "enableLogDetails": true, "prettifyLogMessage": false, "showCommonLabels": false, "showLabels": false, "showTime": false, "sortOrder": "Descending", "wrapLogMessage": false }, "targets": [ { "expr": "{job=\"$job\", identity=\"$identity\"} |~ \"$domain\" |~ \"$ip\" |~ \"$custom\"", "instant": false, "range": true, "refId": "A" } ], "title": "DNS Logs", "transformations": [], "type": "logs" }, { "collapsed": false, "datasource": null, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 25 }, "id": 14, "panels": [], "title": "Top", "type": "row" }, { "datasource": "${DS_LOKI}", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "auto", "displayMode": "auto" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] }, "unit": "short" }, "overrides": [ { "matcher": { "id": "byName", "options": "qname" }, "properties": [ { "id": "custom.width", "value": 553 } ] }, { "matcher": { "id": "byName", "options": "IP" }, "properties": [ { "id": "custom.width", "value": 195 } ] }, { "matcher": { "id": "byName", "options": "Domains" }, "properties": [ { "id": "custom.width", "value": 668 } ] } ] }, "gridPos": { "h": 16, "w": 11, "x": 0, "y": 26 }, "id": 16, "options": { "showHeader": true, "sortBy": [] }, "pluginVersion": "8.2.6", "targets": [ { "expr": "topk(15, sum(count_over_time( ({job=\"$job\"} | pattern \"<_> <_> <_> <_> <_> <_> <_> <_> <_>\" |~ \"NOERROR\" |~ \"$domain\" |~ \"$ip\" |~ \"$custom\" )[$__range] )) by (qname))", "instant": true, "range": false, "refId": "A" } ], "timeFrom": null, "timeShift": null, "title": "Top Domain Names - NOERROR", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true }, "indexByName": {}, "renameByName": { "Value #A": "Hits", "domain": "Domain Name", "qname": "Domains", "queryip": "IP" } } }, { "id": "sortBy", "options": { "fields": {}, "sort": [ { "desc": true, "field": "Hits" } ] } } ], "type": "table" }, { "datasource": "${DS_LOKI}", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "auto", "displayMode": "auto" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] }, "unit": "short" }, "overrides": [ { "matcher": { "id": "byName", "options": "qname" }, "properties": [ { "id": "custom.width", "value": 553 } ] }, { "matcher": { "id": "byName", "options": "IP" }, "properties": [ { "id": "custom.width", "value": 195 } ] }, { "matcher": { "id": "byName", "options": "Domains" }, "properties": [ { "id": "custom.width", "value": 668 } ] } ] }, "gridPos": { "h": 16, "w": 11, "x": 11, "y": 26 }, "id": 17, "options": { "showHeader": true, "sortBy": [] }, "pluginVersion": "8.2.6", "targets": [ { "expr": "topk(15, sum(count_over_time( ({job=\"$job\"} | pattern \"<_> <_> <_> <_> <_> <_> <_> <_> <_>\" |~ \"NXDOMAIN\" |~ \"$domain\" |~ \"$ip\" |~ \"$custom\" )[$__range] )) by (qname))", "instant": true, "range": false, "refId": "A" } ], "timeFrom": null, "timeShift": null, "title": "Top Domain Names - NXDOMAIN", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true }, "indexByName": {}, "renameByName": { "Value #A": "Hits", "domain": "Domain Name", "qname": "Domains", "queryip": "IP" } } }, { "id": "sortBy", "options": { "fields": {}, "sort": [ { "desc": true, "field": "Hits" } ] } } ], "type": "table" }, { "datasource": "${DS_LOKI}", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "auto", "displayMode": "auto" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] }, "unit": "short" }, "overrides": [ { "matcher": { "id": "byName", "options": "qname" }, "properties": [ { "id": "custom.width", "value": 553 } ] }, { "matcher": { "id": "byName", "options": "IP" }, "properties": [ { "id": "custom.width", "value": 503 } ] } ] }, "gridPos": { "h": 16, "w": 11, "x": 0, "y": 42 }, "id": 8, "options": { "showHeader": true, "sortBy": [] }, "pluginVersion": "8.2.6", "targets": [ { "expr": "topk(15, sum(count_over_time( ({job=\"$job\"} | pattern \"<_> <_> <_> <_> <_> <_> <_> <_> <_>\" |~ \"$domain\" |~ \"$ip\" |~ \"$custom\" )[$__range] )) by (queryip))", "instant": true, "range": false, "refId": "A" } ], "timeFrom": null, "timeShift": null, "title": "Top IP", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true }, "indexByName": {}, "renameByName": { "Value #A": "Hits", "domain": "Domain Name", "queryip": "IP" } } }, { "id": "sortBy", "options": { "fields": {}, "sort": [ { "desc": true, "field": "Hits" } ] } } ], "type": "table" } ], "refresh": "10s", "schemaVersion": 32, "style": "dark", "tags": [], "templating": { "list": [ { "allValue": null, "current": {}, "datasource": "${DS_LOKI}", "definition": "label_values(job)", "description": null, "error": null, "hide": 0, "includeAll": false, "label": null, "multi": false, "name": "job", "options": [], "query": "label_values(job)", "refresh": 1, "regex": "", "skipUrlSync": false, "sort": 0, "type": "query" }, { "allValue": null, "current": {}, "datasource": "${DS_LOKI}", "definition": "label_values(identity)", "description": null, "error": null, "hide": 0, "includeAll": false, "label": null, "multi": false, "name": "identity", "options": [], "query": "label_values(identity)", "refresh": 1, "regex": "", "skipUrlSync": false, "sort": 0, "type": "query" }, { "current": { "selected": true, "text": "", "value": "" }, "description": null, "error": null, "hide": 0, "label": "Domain Name", "name": "domain", "options": [ { "selected": true, "text": "", "value": "" } ], "query": "", "skipUrlSync": false, "type": "textbox" }, { "current": { "selected": true, "text": "", "value": "" }, "description": null, "error": null, "hide": 0, "label": "Query IP", "name": "ip", "options": [ { "selected": true, "text": "", "value": "" } ], "query": "", "skipUrlSync": false, "type": "textbox" }, { "current": { "selected": true, "text": "", "value": "" }, "description": null, "error": null, "hide": 0, "label": "Custom Search", "name": "custom", "options": [ { "selected": true, "text": "", "value": "" } ], "query": "", "skipUrlSync": false, "type": "textbox" } ] }, "time": { "from": "now-5m", "to": "now" }, "timepicker": {}, "timezone": "", "title": "DnsCollector Loki v3", "uid": "dlsw4AY7k", "version": 1 }