{ "v": "1", "id": "c3e58f16-5896-425b-bccd-f9bcf45d7cf7", "rev": 4, "name": "Exim", "summary": "schulze.xyz exim dashboard", "description": "", "vendor": "schulze.xyz", "url": "", "parameters": [], "entities": [ { "v": "1", "type": { "name": "dashboard", "version": "2" }, "id": "a74ada49-7e1c-4caa-ba59-099de5c22d34", "data": { "summary": { "@type": "string", "@value": "Mail Dashboard" }, "search": { "queries": [ { "id": "0508f7cd-9e2b-40c5-8e80-7656f888c75f", "timerange": { "type": "relative", "from": 300 }, "query": { "type": "elasticsearch", "query_string": "" }, "search_types": [ { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "field": "login_failed_user", "limit": 20 } ], "type": "pivot", "id": "f77683ad-df75-476a-9686-8ea1c66a8806", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "field": "login_failed_ip_geolocation", "limit": 1000 } ], "type": "pivot", "id": "620c0a70-684c-46eb-ba51-78db72cd43e6", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "field": "login_failed_ip_country_code", "limit": 20 } ], "type": "pivot", "id": "ef214d9d-af6b-43aa-9bef-fbc977cd4052", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 1 } } ], "type": "pivot", "id": "684be29f-3325-4e42-9d5c-346c4e963cf9", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "_exists_: login_failed_user" }, "name": null, "timerange": { "type": "relative", "from": 604800 }, "offset": 0, "streams": [], "filter": null, "decorators": [], "type": "messages", "id": "b0c77b54-8ff4-44ac-863a-83f922a7a7d2", "limit": 150 } ] }, { "id": "79ff2ddd-0188-4e08-9242-d05c47e2e08f", "timerange": { "type": "relative", "from": 300 }, "query": { "type": "elasticsearch", "query_string": "" }, "search_types": [ { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": "X" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "field": "X", "limit": 10 } ], "type": "pivot", "id": "2992b86a-e49a-4e2d-a01d-1b7c4d83c13a", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": "P" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "field": "P", "limit": 10 } ], "type": "pivot", "id": "4f7c9fdf-4fea-47f8-94a7-44ba83676c16", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": "X" } ], "filter": null, "rollup": false, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 2 } } ], "type": "pivot", "id": "3de28dd3-7a75-4525-b682-08fb0771b1b8", "column_groups": [ { "type": "values", "field": "X", "limit": 15 } ], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "_exists_:arguments" }, "name": null, "timerange": { "type": "relative", "from": 604800 }, "offset": 0, "streams": [], "filter": null, "decorators": [], "type": "messages", "id": "cdaf916a-dd69-4f6b-a5b7-7f81e29dcf0c", "limit": 150 }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Amount", "field": "P" } ], "filter": null, "rollup": false, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 2 } } ], "type": "pivot", "id": "27a5d483-1e11-45fc-a646-742aae4d2a2d", "column_groups": [ { "type": "values", "field": "P", "limit": 15 } ], "sort": [] } ] }, { "id": "912b6582-1ce2-44df-bfc2-705e51afe3d4", "timerange": { "type": "relative", "range": 300 }, "query": { "type": "elasticsearch", "query_string": "" }, "search_types": [ { "query": { "type": "elasticsearch", "query_string": "T:virtual_local_dovecot_delivery" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "8e3cc5dc-c5fe-40d5-807b-707771396e6c", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "SA" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "avg", "id": "Score (avg)", "field": "spam_value" } ], "filter": null, "rollup": true, "row_groups": [], "type": "pivot", "id": "15c7a7b2-4399-446d-b580-0fd5ef4b3e0b", "column_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.4 } } ], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "T:virtual_local_dovecot_delivery" }, "name": "trend", "timerange": { "type": "offset", "source": "search_type", "id": "8e3cc5dc-c5fe-40d5-807b-707771396e6c", "offset": "1i" }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "552ebbc2-a9a3-4956-8569-8fd55dab0a34", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "SA" }, "name": "trend", "timerange": { "type": "offset", "source": "search_type", "id": "15c7a7b2-4399-446d-b580-0fd5ef4b3e0b", "offset": "1i" }, "streams": [], "series": [ { "type": "avg", "id": "Score (avg)", "field": "spam_value" } ], "filter": null, "rollup": true, "row_groups": [], "type": "pivot", "id": "23ad994b-fc94-462b-85cc-ac3849412432", "column_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.4 } } ], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "DNS Blacklist", "field": "dnsbl" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "field": "dnsbl", "limit": 20 } ], "type": "pivot", "id": "ac1961f4-0d64-4501-bee3-5fc88f6d482b", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "rejected_reason:SPF" }, "name": "trend", "timerange": { "type": "offset", "source": "search_type", "id": "2abf69ff-5c0f-4445-9477-ffb763312988", "offset": "1i" }, "streams": [], "series": [ { "type": "count", "id": "Rejected Messages", "field": "rejected_reason" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "3a689597-059a-441a-aef4-6d2fa9d8c12b", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "rejected_reason:DNSBL" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Rejected Messages", "field": "rejected_reason" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "1453fd04-1069-4f7f-9029-753ecf7f5a8e", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "dkim" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "count(dkim)", "field": "dkim" } ], "filter": null, "rollup": false, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.5 } } ], "type": "pivot", "id": "870d0f8e-280f-40d3-91f5-58ff674d633b", "column_groups": [ { "type": "values", "field": "dkim", "limit": 15 } ], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "rejected_reason:SPF" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Rejected Messages", "field": "rejected_reason" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "2abf69ff-5c0f-4445-9477-ffb763312988", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "_exists_:mail_id" }, "name": null, "timerange": { "type": "relative", "range": 86400 }, "offset": 0, "streams": [], "filter": null, "decorators": [], "type": "messages", "id": "91240cab-03c1-4675-811d-d572852b7445", "limit": 150 }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": false, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 1 } } ], "type": "pivot", "id": "1b87655d-7413-40cc-b6e3-629c7b881536", "column_groups": [ { "type": "values", "field": "dnsbl", "limit": 20 } ], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "T:remote_smtp" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "9bb96b05-01a7-421b-8659-c5c957d21409", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "Rejected Messages", "field": "rejected_reason" } ], "filter": null, "rollup": false, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.4 } } ], "type": "pivot", "id": "db6559e3-b8f8-4450-8179-6c2363842e86", "column_groups": [ { "type": "values", "field": "rejected_reason", "limit": 15 } ], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "T:remote_smtp" }, "name": "trend", "timerange": { "type": "offset", "source": "search_type", "id": "9bb96b05-01a7-421b-8659-c5c957d21409", "offset": "1i" }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "44923aa1-06df-43f9-9801-c9fdcbba5c25", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "type": "relative", "from": 7200 }, "streams": [], "series": [ { "type": "avg", "id": "Score (avg)", "field": "spam_value" }, { "type": "max", "id": "Score (max)", "field": "spam_value" }, { "type": "min", "id": "Score (min)", "field": "spam_value" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 2 } } ], "type": "pivot", "id": "211feddc-4d12-434e-8e68-c859195845d5", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "rejected_reason:DNSBL" }, "name": "trend", "timerange": { "type": "offset", "source": "search_type", "id": "1453fd04-1069-4f7f-9029-753ecf7f5a8e", "offset": "1i" }, "streams": [], "series": [ { "type": "count", "id": "Rejected Messages", "field": "rejected_reason" } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.2 } } ], "type": "pivot", "id": "c9843f18-678e-44d3-bff7-8a510e708293", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "T:virtual_local_dovecot_delivery" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.4 } } ], "type": "pivot", "id": "f79c4a98-6d73-4c48-b6b3-a6107ab652a1", "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "T:smtp" }, "name": "chart", "timerange": { "type": "relative", "from": 604800 }, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 0.4 } } ], "type": "pivot", "id": "08a4c573-3302-488c-a93d-78dcca70c163", "column_groups": [], "sort": [] } ] } ], "parameters": [], "requires": {}, "owner": "admin", "created_at": "2022-02-18T15:24:35.525Z" }, "created_at": "2020-11-03T12:42:44.842Z", "requires": {}, "state": { "912b6582-1ce2-44df-bfc2-705e51afe3d4": { "selected_fields": null, "static_message_list_id": null, "titles": { "widget": { "c13fb38a-0385-4cb6-ad9f-4686dea6f7f1": "DKIM statistics", "79939388-720a-4946-9290-9efcdf76ec90": "SPF reject", "7ebe5150-3b75-4611-bcaa-2db6d9d0fc25": "Incoming Email", "10a23872-d40a-4ada-93ba-044b6b263fc2": "Outgoing Email", "a9daccbb-2370-44a6-80ed-0bc5c81ef00d": "Rejected Email", "b771cc75-e6db-4dcf-b3e6-e30895047513": "Outgoing Email", "0e6ef8a7-4105-4afe-bf34-c93b7a99206c": "DNSBL Breakdown", "9e9e2737-9c51-4c96-8954-05562a01166c": "Spam Score average", "4be646a1-d133-422c-b441-12400995ba2a": "Spam Score trend", "a55940b2-8f62-41f7-bebd-4c0d12d54444": "Logs", "4054cc35-7db5-40ec-9ed8-c480df24cf3f": "DNSBL Distribution", "a82877e1-dcc7-4131-a0ff-c83bd672bf06": "Incoming Email", "5e65d18d-2850-43e6-8ece-e325718d2299": "DNSBL reject" }, "tab": { "title": "Spam and deliverability" } }, "widgets": [ { "id": "c13fb38a-0385-4cb6-ad9f-4686dea6f7f1", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "dkim" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.5 } } } ], "series": [ { "config": { "name": null }, "function": "count(dkim)" } ], "rollup": false, "column_pivots": [ { "field": "dkim", "type": "values", "config": { "limit": 15 } } ], "visualization_config": { "barmode": "stack" }, "formatting_settings": null, "sort": [] } }, { "id": "a55940b2-8f62-41f7-bebd-4c0d12d54444", "type": "messages", "filter": null, "timerange": { "type": "relative", "range": 86400 }, "query": { "type": "elasticsearch", "query_string": "_exists_:mail_id" }, "streams": [], "config": { "fields": [], "show_message_row": true, "show_summary": null, "decorators": [], "sort": [ { "type": "pivot", "field": "timestamp", "direction": "Descending" } ] } }, { "id": "79939388-720a-4946-9290-9efcdf76ec90", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "rejected_reason:SPF" }, "streams": [], "config": { "visualization": "numeric", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.2 } } } ], "series": [ { "config": { "name": "Rejected Messages" }, "function": "count(rejected_reason)" } ], "rollup": true, "column_pivots": [], "visualization_config": { "trend": true, "trend_preference": "NEUTRAL" }, "formatting_settings": null, "sort": [] } }, { "id": "a9daccbb-2370-44a6-80ed-0bc5c81ef00d", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.4 } } } ], "series": [ { "config": { "name": "Rejected Messages" }, "function": "count(rejected_reason)" } ], "rollup": false, "column_pivots": [ { "field": "rejected_reason", "type": "values", "config": { "limit": 15 } } ], "visualization_config": { "barmode": "stack" }, "formatting_settings": null, "sort": [] } }, { "id": "b771cc75-e6db-4dcf-b3e6-e30895047513", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "T:remote_smtp" }, "streams": [], "config": { "visualization": "numeric", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.2 } } } ], "series": [ { "config": { "name": null }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": { "trend": true, "trend_preference": "NEUTRAL" }, "formatting_settings": null, "sort": [] } }, { "id": "a82877e1-dcc7-4131-a0ff-c83bd672bf06", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "T:virtual_local_dovecot_delivery" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.4 } } } ], "series": [ { "config": { "name": null }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": { "barmode": "group" }, "formatting_settings": null, "sort": [] } }, { "id": "7ebe5150-3b75-4611-bcaa-2db6d9d0fc25", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "T:virtual_local_dovecot_delivery" }, "streams": [], "config": { "visualization": "numeric", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.2 } } } ], "series": [ { "config": { "name": null }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": { "trend": true, "trend_preference": "NEUTRAL" }, "formatting_settings": null, "sort": [] } }, { "id": "9e9e2737-9c51-4c96-8954-05562a01166c", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "SA" }, "streams": [], "config": { "visualization": "numeric", "event_annotation": false, "row_pivots": [], "series": [ { "config": { "name": "Score (avg)" }, "function": "avg(spam_value)" } ], "rollup": true, "column_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.4 } } } ], "visualization_config": { "trend": true, "trend_preference": "LOWER" }, "formatting_settings": null, "sort": [] } }, { "id": "10a23872-d40a-4ada-93ba-044b6b263fc2", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "T:smtp" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.4 } } } ], "series": [ { "config": { "name": null }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": { "barmode": "group" }, "formatting_settings": null, "sort": [] } }, { "id": "0e6ef8a7-4105-4afe-bf34-c93b7a99206c", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 1 } } } ], "series": [ { "config": { "name": null }, "function": "count()" } ], "rollup": false, "column_pivots": [ { "field": "dnsbl", "type": "values", "config": { "limit": 20 } } ], "visualization_config": { "barmode": "stack" }, "formatting_settings": null, "sort": [] } }, { "id": "5e65d18d-2850-43e6-8ece-e325718d2299", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "rejected_reason:DNSBL" }, "streams": [], "config": { "visualization": "numeric", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 0.2 } } } ], "series": [ { "config": { "name": "Rejected Messages" }, "function": "count(rejected_reason)" } ], "rollup": true, "column_pivots": [], "visualization_config": { "trend": true, "trend_preference": "NEUTRAL" }, "formatting_settings": null, "sort": [] } }, { "id": "4054cc35-7db5-40ec-9ed8-c480df24cf3f", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "pie", "event_annotation": false, "row_pivots": [ { "field": "dnsbl", "type": "values", "config": { "limit": 20 } } ], "series": [ { "config": { "name": "DNS Blacklist" }, "function": "count(dnsbl)" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] } }, { "id": "4be646a1-d133-422c-b441-12400995ba2a", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 7200 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "line", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 2 } } } ], "series": [ { "config": { "name": "Score (avg)" }, "function": "avg(spam_value)" }, { "config": { "name": "Score (max)" }, "function": "max(spam_value)" }, { "config": { "name": "Score (min)" }, "function": "min(spam_value)" } ], "rollup": true, "column_pivots": [], "visualization_config": { "interpolation": "spline" }, "formatting_settings": null, "sort": [] } } ], "widget_mapping": { "c13fb38a-0385-4cb6-ad9f-4686dea6f7f1": [ "870d0f8e-280f-40d3-91f5-58ff674d633b" ], "79939388-720a-4946-9290-9efcdf76ec90": [ "3a689597-059a-441a-aef4-6d2fa9d8c12b", "2abf69ff-5c0f-4445-9477-ffb763312988" ], "7ebe5150-3b75-4611-bcaa-2db6d9d0fc25": [ "552ebbc2-a9a3-4956-8569-8fd55dab0a34", "8e3cc5dc-c5fe-40d5-807b-707771396e6c" ], "10a23872-d40a-4ada-93ba-044b6b263fc2": [ "08a4c573-3302-488c-a93d-78dcca70c163" ], "a9daccbb-2370-44a6-80ed-0bc5c81ef00d": [ "db6559e3-b8f8-4450-8179-6c2363842e86" ], "b771cc75-e6db-4dcf-b3e6-e30895047513": [ "44923aa1-06df-43f9-9801-c9fdcbba5c25", "9bb96b05-01a7-421b-8659-c5c957d21409" ], "0e6ef8a7-4105-4afe-bf34-c93b7a99206c": [ "1b87655d-7413-40cc-b6e3-629c7b881536" ], "9e9e2737-9c51-4c96-8954-05562a01166c": [ "15c7a7b2-4399-446d-b580-0fd5ef4b3e0b", "23ad994b-fc94-462b-85cc-ac3849412432" ], "4be646a1-d133-422c-b441-12400995ba2a": [ "211feddc-4d12-434e-8e68-c859195845d5" ], "a55940b2-8f62-41f7-bebd-4c0d12d54444": [ "91240cab-03c1-4675-811d-d572852b7445" ], "4054cc35-7db5-40ec-9ed8-c480df24cf3f": [ "ac1961f4-0d64-4501-bee3-5fc88f6d482b" ], "a82877e1-dcc7-4131-a0ff-c83bd672bf06": [ "f79c4a98-6d73-4c48-b6b3-a6107ab652a1" ], "5e65d18d-2850-43e6-8ece-e325718d2299": [ "c9843f18-678e-44d3-bff7-8a510e708293", "1453fd04-1069-4f7f-9029-753ecf7f5a8e" ] }, "positions": { "c13fb38a-0385-4cb6-ad9f-4686dea6f7f1": { "col": 1, "row": 76, "height": 3, "width": 7 }, "79939388-720a-4946-9290-9efcdf76ec90": { "col": 9, "row": 74, "height": 2, "width": 2 }, "7ebe5150-3b75-4611-bcaa-2db6d9d0fc25": { "col": 11, "row": 72, "height": 2, "width": 2 }, "10a23872-d40a-4ada-93ba-044b6b263fc2": { "col": 1, "row": 70, "height": 2, "width": 10 }, "a9daccbb-2370-44a6-80ed-0bc5c81ef00d": { "col": 1, "row": 74, "height": 2, "width": 8 }, "b771cc75-e6db-4dcf-b3e6-e30895047513": { "col": 11, "row": 70, "height": 2, "width": 2 }, "0e6ef8a7-4105-4afe-bf34-c93b7a99206c": { "col": 1, "row": 79, "height": 3, "width": 7 }, "9e9e2737-9c51-4c96-8954-05562a01166c": { "col": 11, "row": 68, "height": 2, "width": 2 }, "4be646a1-d133-422c-b441-12400995ba2a": { "col": 1, "row": 68, "height": 2, "width": 10 }, "a55940b2-8f62-41f7-bebd-4c0d12d54444": { "col": 1, "row": 82, "height": 5, "width": "Infinity" }, "4054cc35-7db5-40ec-9ed8-c480df24cf3f": { "col": 8, "row": 76, "height": 6, "width": 5 }, "a82877e1-dcc7-4131-a0ff-c83bd672bf06": { "col": 1, "row": 72, "height": 2, "width": 10 }, "5e65d18d-2850-43e6-8ece-e325718d2299": { "col": 11, "row": 74, "height": 2, "width": 2 } }, "formatting": { "highlighting": [] }, "display_mode_settings": { "positions": {} } }, "79ff2ddd-0188-4e08-9242-d05c47e2e08f": { "selected_fields": null, "static_message_list_id": null, "titles": { "tab": { "title": "Connection Metrics" }, "widget": { "67d48e4f-dcdf-4d07-bd63-23ecbd312706": "Transport Encryption", "ad3b927d-0666-4a67-9258-7d92bf516194": "Transport Protocol", "e06aebb6-2822-4b11-97ea-0d4bff7d90e9": "Logs", "9ffe3ffe-c4a8-4264-9fd5-83a0bce5bf56": "Transport Protocol", "2731de0a-6685-4cfd-a748-3ac865d9686d": "Transport Encryption" } }, "widgets": [ { "id": "2731de0a-6685-4cfd-a748-3ac865d9686d", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 2 } } } ], "series": [ { "config": { "name": "Amount" }, "function": "count(X)" } ], "rollup": false, "column_pivots": [ { "field": "X", "type": "values", "config": { "limit": 15 } } ], "visualization_config": { "barmode": "stack" }, "formatting_settings": null, "sort": [] } }, { "id": "e06aebb6-2822-4b11-97ea-0d4bff7d90e9", "type": "messages", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "_exists_:arguments" }, "streams": [], "config": { "fields": [], "show_message_row": true, "show_summary": null, "decorators": [], "sort": [ { "type": "pivot", "field": "timestamp", "direction": "Descending" } ] } }, { "id": "67d48e4f-dcdf-4d07-bd63-23ecbd312706", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "table", "event_annotation": false, "row_pivots": [ { "field": "X", "type": "values", "config": { "limit": 10 } } ], "series": [ { "config": { "name": "Amount" }, "function": "count(X)" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] } }, { "id": "9ffe3ffe-c4a8-4264-9fd5-83a0bce5bf56", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 2 } } } ], "series": [ { "config": { "name": "Amount" }, "function": "count(P)" } ], "rollup": false, "column_pivots": [ { "field": "P", "type": "values", "config": { "limit": 15 } } ], "visualization_config": { "barmode": "stack" }, "formatting_settings": null, "sort": [] } }, { "id": "ad3b927d-0666-4a67-9258-7d92bf516194", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "table", "event_annotation": false, "row_pivots": [ { "field": "P", "type": "values", "config": { "limit": 10 } } ], "series": [ { "config": { "name": "Amount" }, "function": "count(P)" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] } } ], "widget_mapping": { "2731de0a-6685-4cfd-a748-3ac865d9686d": [ "3de28dd3-7a75-4525-b682-08fb0771b1b8" ], "e06aebb6-2822-4b11-97ea-0d4bff7d90e9": [ "cdaf916a-dd69-4f6b-a5b7-7f81e29dcf0c" ], "67d48e4f-dcdf-4d07-bd63-23ecbd312706": [ "2992b86a-e49a-4e2d-a01d-1b7c4d83c13a" ], "9ffe3ffe-c4a8-4264-9fd5-83a0bce5bf56": [ "27a5d483-1e11-45fc-a646-742aae4d2a2d" ], "ad3b927d-0666-4a67-9258-7d92bf516194": [ "4f7c9fdf-4fea-47f8-94a7-44ba83676c16" ] }, "positions": { "ad3b927d-0666-4a67-9258-7d92bf516194": { "col": 1, "row": 6, "height": 3, "width": 4 }, "67d48e4f-dcdf-4d07-bd63-23ecbd312706": { "col": 1, "row": 9, "height": 3, "width": 4 }, "9ffe3ffe-c4a8-4264-9fd5-83a0bce5bf56": { "col": 5, "row": 6, "height": 3, "width": 8 }, "2731de0a-6685-4cfd-a748-3ac865d9686d": { "col": 5, "row": 9, "height": 3, "width": 8 }, "e06aebb6-2822-4b11-97ea-0d4bff7d90e9": { "col": 1, "row": 12, "height": 5, "width": "Infinity" } }, "formatting": { "highlighting": [] }, "display_mode_settings": { "positions": {} } }, "0508f7cd-9e2b-40c5-8e80-7656f888c75f": { "selected_fields": null, "static_message_list_id": null, "titles": { "tab": { "title": "Failed Logins" }, "widget": { "54b9ec60-e633-4170-bf2e-795daa214506": "Logs", "a5f0c8f7-7dbc-4329-be43-fe809db0ec74": "Attacked users", "022e6cfe-37f0-4708-8ad7-cfe4b0c96449": "Countries", "892d04c6-5088-421c-9762-84a102a4224e": "Logs (copy)", "1c589c23-7196-492e-9bf9-fa9f03c8e727": "Attacks" } }, "widgets": [ { "id": "1c589c23-7196-492e-9bf9-fa9f03c8e727", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "line", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 1 } } } ], "series": [ { "config": { "name": "Amount" }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": { "interpolation": "spline" }, "formatting_settings": null, "sort": [] } }, { "id": "54b9ec60-e633-4170-bf2e-795daa214506", "type": "messages", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "_exists_: login_failed_user" }, "streams": [], "config": { "fields": [], "show_message_row": true, "show_summary": null, "decorators": [], "sort": [ { "type": "pivot", "field": "timestamp", "direction": "Descending" } ] } }, { "id": "a5f0c8f7-7dbc-4329-be43-fe809db0ec74", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "table", "event_annotation": false, "row_pivots": [ { "field": "login_failed_user", "type": "values", "config": { "limit": 20 } } ], "series": [ { "config": { "name": "Amount" }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] } }, { "id": "88454bd0-0647-410f-95f1-a04d2019fb37", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "map", "event_annotation": false, "row_pivots": [ { "field": "login_failed_ip_geolocation", "type": "values", "config": { "limit": 1000 } } ], "series": [ { "config": { "name": "Amount" }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": { "viewport": { "zoom": 2, "center_x": 0, "center_y": 0 } }, "formatting_settings": null, "sort": [] } }, { "id": "022e6cfe-37f0-4708-8ad7-cfe4b0c96449", "type": "aggregation", "filter": null, "timerange": { "type": "relative", "from": 604800 }, "query": { "type": "elasticsearch", "query_string": "" }, "streams": [], "config": { "visualization": "table", "event_annotation": false, "row_pivots": [ { "field": "login_failed_ip_country_code", "type": "values", "config": { "limit": 20 } } ], "series": [ { "config": { "name": "Amount" }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] } } ], "widget_mapping": { "54b9ec60-e633-4170-bf2e-795daa214506": [ "b0c77b54-8ff4-44ac-863a-83f922a7a7d2" ], "a5f0c8f7-7dbc-4329-be43-fe809db0ec74": [ "f77683ad-df75-476a-9686-8ea1c66a8806" ], "88454bd0-0647-410f-95f1-a04d2019fb37": [ "620c0a70-684c-46eb-ba51-78db72cd43e6" ], "1c589c23-7196-492e-9bf9-fa9f03c8e727": [ "684be29f-3325-4e42-9d5c-346c4e963cf9" ], "022e6cfe-37f0-4708-8ad7-cfe4b0c96449": [ "ef214d9d-af6b-43aa-9bef-fbc977cd4052" ] }, "positions": { "1c589c23-7196-492e-9bf9-fa9f03c8e727": { "col": 1, "row": 7, "height": 2, "width": "Infinity" }, "022e6cfe-37f0-4708-8ad7-cfe4b0c96449": { "col": 11, "row": 1, "height": 6, "width": 2 }, "88454bd0-0647-410f-95f1-a04d2019fb37": { "col": 1, "row": 1, "height": 6, "width": 8 }, "a5f0c8f7-7dbc-4329-be43-fe809db0ec74": { "col": 9, "row": 1, "height": 6, "width": 2 }, "54b9ec60-e633-4170-bf2e-795daa214506": { "col": 1, "row": 9, "height": 5, "width": "Infinity" } }, "formatting": { "highlighting": [] }, "display_mode_settings": { "positions": {} } } }, "properties": [], "owner": "admin", "title": { "@type": "string", "@value": "Exim" }, "type": "DASHBOARD", "description": { "@type": "string", "@value": "" } }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] }, { "v": "1", "type": { "name": "input", "version": "1" }, "id": "dc0118d7-59a2-4805-97bf-20071fe8bb76", "data": { "title": { "@type": "string", "@value": "Exim Logs" }, "configuration": { "tls_key_file": { "@type": "string", "@value": "" }, "port": { "@type": "integer", "@value": 5604 }, "tls_enable": { "@type": "boolean", "@value": false }, "recv_buffer_size": { "@type": "integer", "@value": 1048576 }, "tcp_keepalive": { "@type": "boolean", "@value": false }, "tls_client_auth_cert_file": { "@type": "string", "@value": "" }, "bind_address": { "@type": "string", "@value": "0.0.0.0" }, "no_beats_prefix": { "@type": "boolean", "@value": true }, "tls_cert_file": { "@type": "string", "@value": "" }, "tls_client_auth": { "@type": "string", "@value": "disabled" }, "number_worker_threads": { "@type": "integer", "@value": 4 }, "tls_key_password": { "@type": "string", "@value": "" } }, "static_fields": { "service": { "@type": "string", "@value": "exim" } }, "type": { "@type": "string", "@value": "org.graylog.plugins.beats.Beats2Input" }, "global": { "@type": "boolean", "@value": true }, "extractors": [ { "target_field": { "@type": "string", "@value": "mail_id" }, "condition_value": { "@type": "string", "@value": "" }, "order": { "@type": "integer", "@value": 1 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "\\ ([a-zA-Z0-9]{6}\\-[a-zA-Z0-9]{6}\\-[a-zA-Z0-9]{2})\\ " } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Extract Mail ID" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "NONE" } }, { "target_field": { "@type": "string", "@value": "spamassassin" }, "condition_value": { "@type": "string", "@value": "SA:" }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "Action: ([^:]+):" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Spamassssin" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "spf" }, "condition_value": { "@type": "string", "@value": "rejected RCPT" }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "SPF\\ check\\ (failed).$" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "SPF failed" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "rejected_msg" }, "condition_value": { "@type": "string", "@value": "rejected RCPT" }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": ">: (.*)$" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Rejected message" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "message" }, "condition_value": { "@type": "string", "@value": "DKIM:" }, "order": { "@type": "integer", "@value": 0 }, "converters": [ { "type": { "@type": "string", "@value": "TOKENIZER" }, "configuration": {} } ], "configuration": {}, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "DKIM splitter" }, "type": { "@type": "string", "@value": "COPY_INPUT" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "rejected_reason" }, "condition_value": { "@type": "string", "@value": "" }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "^([^\\ ]+)\\ " } }, "source_field": { "@type": "string", "@value": "rejected_msg" }, "title": { "@type": "string", "@value": "Reason for reject" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "NONE" } }, { "target_field": { "@type": "string", "@value": "arguments" }, "condition_value": { "@type": "string", "@value": "\\ (<=|=>)\\ " }, "order": { "@type": "integer", "@value": 0 }, "converters": [ { "type": { "@type": "string", "@value": "TOKENIZER" }, "configuration": {} } ], "configuration": { "regex_value": { "@type": "string", "@value": "([A-Z]=.*)$" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Split arguments" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "REGEX" } }, { "target_field": { "@type": "string", "@value": "spam_value" }, "condition_value": { "@type": "string", "@value": "SA:" }, "order": { "@type": "integer", "@value": 0 }, "converters": [ { "type": { "@type": "string", "@value": "NUMERIC" }, "configuration": {} } ], "configuration": { "regex_value": { "@type": "string", "@value": ": score=(.+) required=" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Spam Score" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "login_failed_ip" }, "condition_value": { "@type": "string", "@value": "login_server authenticator failed" }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": " \\[([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})\\]: " } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Failed login IP" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "login_failed_user" }, "condition_value": { "@type": "string", "@value": "login_server authenticator failed " }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "535 Incorrect authentication data \\(set_id=(.+)\\)$" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Failed login user" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "dnsbl" }, "condition_value": { "@type": "string", "@value": "^DNSBL\\ " }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "listed at ([^\\(]*) \\(" } }, "source_field": { "@type": "string", "@value": "rejected_msg" }, "title": { "@type": "string", "@value": "Which DNSBL" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "REGEX" } }, { "target_field": { "@type": "string", "@value": "dkim" }, "condition_value": { "@type": "string", "@value": "DKIM:" }, "order": { "@type": "integer", "@value": 0 }, "converters": [], "configuration": { "regex_value": { "@type": "string", "@value": "\\[(verification [^\\ ]+|invalid).*\\]$" } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "DKIM status" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "STRING" } }, { "target_field": { "@type": "string", "@value": "timestamp" }, "condition_value": { "@type": "string", "@value": "^[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}" }, "order": { "@type": "integer", "@value": 0 }, "converters": [ { "type": { "@type": "string", "@value": "DATE" }, "configuration": { "time_zone": { "@type": "string", "@value": "Europe/Berlin" }, "date_format": { "@type": "string", "@value": "yyyy-MM-dd HH:mm:ss" }, "locale": { "@type": "string", "@value": "en-US" } } } ], "configuration": { "regex_value": { "@type": "string", "@value": "^([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}) " } }, "source_field": { "@type": "string", "@value": "message" }, "title": { "@type": "string", "@value": "Use log timestamp" }, "type": { "@type": "string", "@value": "REGEX" }, "cursor_strategy": { "@type": "string", "@value": "COPY" }, "condition_type": { "@type": "string", "@value": "REGEX" } } ] }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] }, { "v": "1", "type": { "name": "pipeline", "version": "1" }, "id": "09f9866c-6957-4e0c-a836-7cb527a08813", "data": { "title": { "@type": "string", "@value": "Exim Cleanup" }, "description": { "@type": "string", "@value": "Cleanup Exim Logs" }, "source": { "@type": "string", "@value": "pipeline \"Exim Cleanup\"\nstage 0 match either\nrule \"Cleanup filebeat fields\"\nrule \"Cleanup exim fields\"\nend" }, "connected_streams": [ { "@type": "string", "@value": "85f58bd5-3386-4188-88df-57bc7d8264a8" } ] }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] }, { "v": "1", "type": { "name": "pipeline_rule", "version": "1" }, "id": "bcfda920-e11f-4ef1-a44d-d1286d68fbd1", "data": { "title": { "@type": "string", "@value": "Cleanup filebeat fields" }, "description": { "@type": "string", "@value": "Cleanup filebeat fields, always run" }, "source": { "@type": "string", "@value": "rule \"Cleanup filebeat fields\"\nwhen\n true\nthen\n remove_field(\"@metadata_beat\");\n remove_field(\"@metadata_type\");\n remove_field(\"@metadata_version\");\n remove_field(\"@timestamp\");\n \n remove_field(\"beats_type\");\n remove_field(\"beat_name\");\n remove_field(\"beat_hostname\");\n remove_field(\"beat_version\");\nend" } }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] }, { "v": "1", "type": { "name": "pipeline_rule", "version": "1" }, "id": "73131dbe-da40-4a70-9a23-d275acddc718", "data": { "title": { "@type": "string", "@value": "Cleanup exim fields" }, "description": { "@type": "string", "@value": "Cleanup exim fields" }, "source": { "@type": "string", "@value": "rule \"Cleanup exim fields\"\nwhen\n\n from_input(name: \"Exim Logs\")\n\nthen\n\n rename_field(\"fields_mx\", \"mx\");\n rename_field(\"host_name\", \"hostname\");\n\nend" } }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] }, { "v": "1", "type": { "name": "search", "version": "1" }, "id": "f1b2b009-21d2-468a-b6e0-0a6752047773", "data": { "summary": { "@type": "string", "@value": "" }, "search": { "queries": [ { "id": "652cd5c5-623c-4f70-83f2-5d7da7cf5841", "timerange": { "type": "relative", "range": 86400 }, "filter": { "type": "or", "filters": [ { "type": "stream", "id": "85f58bd5-3386-4188-88df-57bc7d8264a8" } ] }, "query": { "type": "elasticsearch", "query_string": "_exists_:mail_id" }, "search_types": [ { "query": null, "name": null, "timerange": null, "offset": 0, "streams": [], "filter": null, "decorators": [], "type": "messages", "id": "08c8a472-dc54-4ead-b0f1-e710eba510fd", "limit": 150 }, { "query": null, "name": "chart", "timerange": null, "streams": [], "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "field": "timestamp", "interval": { "type": "auto", "scaling": 1 } } ], "type": "pivot", "id": "fd2ec361-6662-402a-9d12-0055980655ea", "column_groups": [], "sort": [] } ] } ], "parameters": [], "requires": {}, "owner": "admin", "created_at": "2020-11-03T12:50:50.316Z" }, "created_at": "2020-11-03T12:49:44.850Z", "requires": {}, "state": { "652cd5c5-623c-4f70-83f2-5d7da7cf5841": { "selected_fields": null, "static_message_list_id": null, "titles": { "widget": { "46eaabfb-ba1b-48b5-8423-cb561ace66b1": "Message Count", "300f2a2e-28f9-4a4d-a012-e66217f53307": "All Messages" } }, "widgets": [ { "id": "46eaabfb-ba1b-48b5-8423-cb561ace66b1", "type": "aggregation", "filter": null, "timerange": null, "query": null, "streams": [], "config": { "visualization": "bar", "event_annotation": false, "row_pivots": [ { "field": "timestamp", "type": "time", "config": { "interval": { "type": "auto", "scaling": 1 } } } ], "series": [ { "config": { "name": null }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] } }, { "id": "300f2a2e-28f9-4a4d-a012-e66217f53307", "type": "messages", "filter": null, "timerange": null, "query": null, "streams": [], "config": { "fields": [ "timestamp", "source" ], "show_message_row": true, "show_summary": null, "decorators": [], "sort": [ { "type": "pivot", "field": "timestamp", "direction": "Descending" } ] } } ], "widget_mapping": { "46eaabfb-ba1b-48b5-8423-cb561ace66b1": [ "fd2ec361-6662-402a-9d12-0055980655ea" ], "300f2a2e-28f9-4a4d-a012-e66217f53307": [ "08c8a472-dc54-4ead-b0f1-e710eba510fd" ] }, "positions": { "46eaabfb-ba1b-48b5-8423-cb561ace66b1": { "col": 1, "row": 1, "height": 2, "width": "Infinity" }, "300f2a2e-28f9-4a4d-a012-e66217f53307": { "col": 1, "row": 3, "height": 6, "width": "Infinity" } }, "formatting": { "highlighting": [] }, "display_mode_settings": { "positions": {} } } }, "properties": [], "owner": "admin", "title": { "@type": "string", "@value": "Email" }, "type": "SEARCH", "description": { "@type": "string", "@value": "" } }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] }, { "v": "1", "type": { "name": "stream", "version": "1" }, "id": "85f58bd5-3386-4188-88df-57bc7d8264a8", "data": { "alarm_callbacks": [], "outputs": [], "remove_matches": { "@type": "boolean", "@value": true }, "title": { "@type": "string", "@value": "Exim Logs" }, "stream_rules": [ { "type": { "@type": "string", "@value": "EXACT" }, "field": { "@type": "string", "@value": "service" }, "value": { "@type": "string", "@value": "exim" }, "inverted": { "@type": "boolean", "@value": false }, "description": { "@type": "string", "@value": "" } } ], "alert_conditions": [], "matching_type": { "@type": "string", "@value": "AND" }, "disabled": { "@type": "boolean", "@value": false }, "description": { "@type": "string", "@value": "Logs from my MX servers" }, "default_stream": { "@type": "boolean", "@value": false } }, "constraints": [ { "type": "server-version", "version": ">=4.2.6+0210617" } ] } ] }