diff options
Diffstat (limited to 'fail2ban.yml')
| -rw-r--r-- | fail2ban.yml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/fail2ban.yml b/fail2ban.yml new file mode 100644 index 0000000..bdec775 --- /dev/null +++ b/fail2ban.yml @@ -0,0 +1,31 @@ +- type: filestream + id: fail2ban + enabled: true + paths: + - /var/log/fail2ban.log + include_lines: ['Ban','Unban','Found'] + processors: + - add_tags: + tags: ['fail2ban'] + target: "service.type" + - add_tags: + tags: ['fail2ban'] + target: "event.module" + - add_tags: + tags: ['intrusion_detection'] + target: "event.category" + - dissect: + when: + contains: + message: "INFO" + tokenizer: "%{+timestamp} %{+timestamp} %{component->} [%{pid}]: %{log_level->} [%{jail}] %{action} %{ip|ip} - %{} %{}" + field: "message" + target_prefix: "fail2ban" + - dissect: + when: + contains: + message: "NOTICE" + tokenizer: "%{+timestamp} %{+timestamp} %{component->} [%{pid}]: %{log_level->} [%{jail}] %{action} %{ip|ip}" + field: "message" + target_prefix: "fail2ban" + |