Creating graph from logs using labels

Hello everybody,

I am wrestling with my new installation of Promtail-Loki-Grafana to obtain a graph from Fail2ban showing the amount of detection by IP.

For now my request is the following :

count_over_time({filename=“/var/log/fail2ban.log”} |= Ban | logfmt | pattern <date> <time>,<_> fail2ban.<_> [<_>]: <_> [<service>] <action> <ip> [24h])

It’s creating a label for each line in the following format :

{action=“Ban”, date=“2024-01-01”, filename=“/var/log/fail2ban.log”, ip=“88.214.25.241”, job=“varlogs”, service=“sshd”, time=“21:00:39”}

I expected to have several labels : action, ip, service, date, time. Maybe there is another approach to do this but at this moment every search I do point to this method or regex but I don’t really understand how to extract the desired labels and use them as axis in a barchart for example. How can I achieve this result ?

Thank you in advance for looking at my post

You should be able to use any parsed field like this (the level field is extracted using the logfmt parser)

sum by (level) (count_over_time({container="prometheus"} | logfmt [1m]))

This gives me a graph per level. The same should be possible using the pattern parser as well.

Thank you, I have been able to do it. It’s easier to setup some labels with promtails to extract the IPs before sending them to Loki with a regex. I also had some issues with the timestamps which were fixed the same way. For additional information, here is my promtail configuration for fail2ban :

- job_name: fail2ban
  static_configs:
  - targets:
      - localhost
    labels:
      job: fail2ban
      __path__: /var/log/fail2ban.log
  pipeline_stages:
  - regex:
      expression: '^(?P<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}) (?P<log_component>[\w.]+)\s+\[(?P<id>\d+)\]: (?P<level>\w+)\s+\[(?P<service>[^\]]+)\] (?P<action>Restore Ban|Increase Ban|Ban|Unban|Found)(?:.*(?:\s|\b))(?P<ip>\d{1,3}(?:\.\d{1,3}){3})(?:, (?P<is_bad>bad))?'
  - timestamp:
      source: timestamp
      format: '2006-01-02 15:04:05,000'
      location: "Europe/Paris"
  - labels:
      service:
      ip:
      action:
      is_bad: