自宅EdgerouterXへアクセスしているIPアドレスをGrafanaで地図上にプロットしてみた。

#### Global directives ####

# Sets the directory that rsyslog uses for work files.
$WorkDirectory /var/lib/rsyslog

# Sets default permissions for all log files.
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#### Modules ####
module(load="imudp")
module(load="mmnormalize")module(load="mmdblookup")
#### Input ####
input(type="imudp" port="52200")

template( name="etcfile" type="string" string="/var/log/rsyslog/%hostname%/%programname%_msg.log")
template( name="locationlog" type="string" string="%timegenerated:::date-rfc3339% %hostname% %programname%: \"%$!iplocation!continent!code%\" \"%$!iplocation!continent!names!en%\" \"%$!iplocation!country!iso_code%\" \"%$!iplocation!country!names!en%\" \"%$!iplocation!city!names!en%\" \"%$!iplocation!location!latitude%\" \"%$!iplocation!location!longitude%\"%msg%\n")
template(name="all-json" type="list"){
  property(name="$!all-json")
}

if $programname == "proxy_access" or $programname == "web_access" then {
    if $msg startswith " -" or $msg startswith " 192.168.1" or $msg startswith " 127.0.0"  or $msg startswith " 24●●:●●●●:●●●●:●●●●" then {
        action(type="omfile" dynaFile="etcfile")
    }
    else {
        action(type="mmnormalize" rulebase="/etc/rsyslog.d/nginx_rule.dat")
        action(type = "mmdblookup" mmdbfile = "/var/lib/geodb/GeoLite2-City.mmdb"
             fields=["!continent!code","!continent!names!en","!country!iso_code","!country!names!en","!city!names!en","!location!latitude","!location!longitude"] key="!clientip" )
        action(type="omfile" template="locationlog" File="/var/log/rsyslog/nginx_access.log")
#        action(type="omfile" template="all-json" File="/var/log/nginx_json_access.log")
    }
} else if $hostname == "akiboiRT" and $programname == "kernel" then {
    if ($msg contains "[DSLite" or $msg contains "[PPPoE" or $msg contains "[WANv6") and not ($msg contains "DST=255.255.255.255") then {
        action(type="mmnormalize" rulebase="/etc/rsyslog.d/router_rule.dat")        action(type = "mmdblookup" mmdbfile = "/var/lib/geodb/GeoLite2-City.mmdb"            fields=["!continent!code","!continent!names!en","!country!iso_code","!country!names!en","!city!names!en","!location!latitude","!location!longitude"] key="!clientip" )        action(type="omfile" template="locationlog" File="/var/log/rsyslog/router_access.log")
#       action(type="omfile" template="all-json" File="/var/log/router_json_access.log")
    } else {
            action(type="omfile" dynaFile="etcfile")
    }
} else {
    action(type="omfile" dynaFile="etcfile")
}

grafana:
  stage: buildContainer
  only:
    changes:
      - backend/rsyslog/**/*  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=rsyslog    - VOLUME="-v $BASEDIR/$CONTAINER/data:/var/lib/geodb:Z -v $BASEDIR/$CONTAINER/log:/var/log:Z "    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST mkdir -p $BASEDIR/$CONTAINER/data $BASEDIR/$CONTAINER/log    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always --name $CONTAINER $VOLUME $REGISTRY/$CONTAINER

backend
├── .gitlab-ci.yml ← add promtail,loki,victory├── blackbox-exporter
│   └── Dockerfile
├── grafana
│   ├── Dockerfile
│   └── build
│       └── grafana.ini
├── loki           ← add│   ├── Dockerfile ← add│   └── build
│       └── local-config.yaml ← add├── pr1
│   ├── Dockerfile
│   ├── build
│   │   ├── conf.d
│   │   │   ├── default.conf
│   │   │   ├── header.conf
│   │   │   └── log.conf
│   │   ├── nginx.conf
│   │   └── vhost.d
│   │       ├── 01_ap-Server.conf
│   │       ├── 03_test-Server.conf
│   │       └── 99_default.conf
│   └── html
│       ├── index4.html
│       └── index6.html
├── prometheus
│   ├── Dockerfile
│   └── build
│       └── prometheus.yml ← add pormtail,victoria├── promtail
│   ├── Dockerfile
│   └── build
│       └── config.yml
├── rsyslog
│   ├── Dockerfile
│   └── build
│       ├── nginx_rule.dat
│       ├── router_rule.dat
│       └── rsyslog.conf
├── snmp-exporter
│   ├── Dockerfile
│   └── build
│       └── snmp.yml
└── victoria           ← add    └── Dockerfile     ← add

:
promtail:
  stage: buildContainer
  only:
    changes:
      - backend/promtail/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=promtail
    - VOLUME=" -v $BASEDIR/rsyslog/log:/var/log:ro " ← rsyslogのログを利用する。    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always --name $CONTAINER $VOLUME $REGISTRY/$CONTAINER

loki:
  stage: buildContainer
  only:
    changes:
      - backend/loki/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=loki
    - VOLUME="-v $BASEDIR/$CONTAINER/data:/victoria-metrics-data:Z "
    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST mkdir -p $BASEDIR/$CONTAINER/data
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always -- name $CONTAINER $VOLUME $REGISTRY/$CONTAINER

lovictoriaki:
  stage: buildContainer
  only:
    changes:
      - backend/victoria/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=victoria
    - VOLUME=""
    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always -- name $CONTAINER $VOLUME $REGISTRY/$CONTAINER
:

scrape_configs:
:
  - job_name: 'promtail'    static_configs:      - targets:          - localhost:9080
# Remote write configuration (for victoria)
remote_write:  - url: http://localhost:8428/api/v1/write