grafana: the egress board filters by domain as well as by agent
A domain variable, the destination host from the proxy's access log, sits beside the agent one and every query on the board filters on both, so one domain and its agents show which agents queried it and when.
This commit is contained in:
iris
parent
5233259b3b
commit
ca1e25b21e
1 changed files with 59 additions and 24 deletions
|
|
@ -6,7 +6,7 @@
|
|||
},
|
||||
"spec": {
|
||||
"title": "hyperhive · egress",
|
||||
"description": "What agents send through the egress proxy: totals, refused requests, and what log mode would deny.",
|
||||
"description": "What agents send through the egress proxy: totals, refused, would-deny. Filter by agent and domain.",
|
||||
"editable": true,
|
||||
"cursorSync": "Off",
|
||||
"liveNow": false,
|
||||
|
|
@ -72,6 +72,41 @@
|
|||
"includeAll": true,
|
||||
"allowCustomValue": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "QueryVariable",
|
||||
"spec": {
|
||||
"name": "domain",
|
||||
"current": {
|
||||
"text": "All",
|
||||
"value": "$__all"
|
||||
},
|
||||
"label": "Domain",
|
||||
"hide": "dontHide",
|
||||
"refresh": "onTimeRangeChanged",
|
||||
"skipUrlSync": false,
|
||||
"query": {
|
||||
"kind": "DataQuery",
|
||||
"group": "victoriametrics-logs-datasource",
|
||||
"version": "v0",
|
||||
"datasource": {
|
||||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"refId": "domain",
|
||||
"type": "fieldValue",
|
||||
"field": "dest",
|
||||
"query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url",
|
||||
"limit": 1000
|
||||
}
|
||||
},
|
||||
"regex": "",
|
||||
"sort": "alphabeticalAsc",
|
||||
"options": [],
|
||||
"multi": true,
|
||||
"includeAll": true,
|
||||
"allowCustomValue": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeSettings": {
|
||||
|
|
@ -117,7 +152,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats count() as requests",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats count() as requests",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -191,7 +226,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats count_uniq(agent) as agents",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats count_uniq(agent) as agents",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -265,7 +300,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count() as refused",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -339,7 +374,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:407 | stats count() as challenges",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:407 | stats count() as challenges",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -413,7 +448,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats sum(bytes) as bytes",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats sum(bytes) as bytes",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -487,7 +522,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | stats count() as requests",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats count() as requests",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -561,7 +596,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (status) count() as requests",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (status) count() as requests",
|
||||
"queryType": "statsRange",
|
||||
"legendFormat": "{{status}}"
|
||||
}
|
||||
|
|
@ -635,7 +670,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (agent) count() as requests | sort by (requests) desc | limit 15",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (agent) count() as requests | sort by (requests) desc | limit 15",
|
||||
"queryType": "stats",
|
||||
"legendFormat": "{{agent}}"
|
||||
}
|
||||
|
|
@ -711,7 +746,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15",
|
||||
"queryType": "stats",
|
||||
"legendFormat": "{{agent}}"
|
||||
}
|
||||
|
|
@ -787,7 +822,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -875,7 +910,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count() as refused",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -949,7 +984,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count_uniq(agent) as agents",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count_uniq(agent) as agents",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -1023,7 +1058,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -1110,7 +1145,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent) count() as requests",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats by (agent) count() as requests",
|
||||
"queryType": "statsRange",
|
||||
"legendFormat": "{{agent}}"
|
||||
}
|
||||
|
|
@ -1184,7 +1219,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403",
|
||||
"queryType": "instant"
|
||||
}
|
||||
},
|
||||
|
|
@ -1240,7 +1275,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | stats count() as requests",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats count() as requests",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -1314,7 +1349,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | stats count_uniq(agent) as agents",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats count_uniq(agent) as agents",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -1388,7 +1423,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | stats by (agent, dest, port) count() as requests | sort by (requests) desc",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats by (agent, dest, port) count() as requests | sort by (requests) desc",
|
||||
"queryType": "stats"
|
||||
}
|
||||
},
|
||||
|
|
@ -1476,7 +1511,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | stats by (agent) count() as requests",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats by (agent) count() as requests",
|
||||
"queryType": "statsRange",
|
||||
"legendFormat": "{{agent}}"
|
||||
}
|
||||
|
|
@ -1550,7 +1585,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain",
|
||||
"queryType": "instant"
|
||||
}
|
||||
},
|
||||
|
|
@ -1606,7 +1641,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats by (dest) sum(bytes) as bytes",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter dest:in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats by (dest) sum(bytes) as bytes",
|
||||
"queryType": "statsRange",
|
||||
"legendFormat": "{{dest}}"
|
||||
}
|
||||
|
|
@ -1626,7 +1661,7 @@
|
|||
"name": "@logsDatasourceUid@"
|
||||
},
|
||||
"spec": {
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:!in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats sum(bytes) as bytes",
|
||||
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter dest:!in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats sum(bytes) as bytes",
|
||||
"queryType": "statsRange",
|
||||
"legendFormat": "other"
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue