Grafana dashboard: Loki - Syslog AIO (All In One)
Description: An example dashboard showing Loki ingested syslogs forwarded from syslog-ng. Part of my Loki Syslog All In One project.

This Loki Syslog All-In-One example is geared to help you get up and running quickly with a Syslog ingestor and visualization of logs. It uses Grafana Loki and Promtail as a receiver for forwarded syslog-ng logs.

Essentially:

RFC3164 Network/Compute Devices -> syslog-ng (UDP port 514) -> Promtail (port 1514) -> Loki (port 3100) <- Grafana (port 3000)

More details here: https://github.com/lux4rd0/grafana-loki-syslog-aio

{
  "__inputs": [
    {
      "name": "DS_LOKI",
      "label": "Loki",
      "description": "syslog-ng -> Promtail -> Loki",
      "type": "datasource",
      "pluginId": "loki",
      "pluginName": "Loki"
    }
  ],
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "7.3.7"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": ""
    },
    {
      "type": "panel",
      "id": "logs",
      "name": "Logs",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "loki",
      "name": "Loki",
      "version": "1.0.0"
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      },
      {
        "datasource": "${DS_LOKI}",
        "enable": false,
        "expr": "{job=\"syslog\"} |=\"DNS request timed out\"",
        "hide": false,
        "iconColor": "#C4162A",
        "limit": 100,
        "name": "DNS Timeout",
        "showIn": 0,
        "tags": [],
        "target": {},
        "type": "tags"
      }
    ]
  },
  "editable": true,
  "gnetId": 13766,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1611342291300,
  "links": [
    {
      "asDropdown": true,
      "icon": "external link",
      "keepTime": true,
      "tags": [
        "performance_overview"
      ],
      "title": "Performance Overview",
      "type": "dashboards"
    }
  ],
  "panels": [
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_LOKI}",
      "fieldConfig": {
        "defaults": {
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 6,
      "gridPos": {
        "h": 9,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "hiddenSeries": false,
      "id": 3,
      "interval": "$smooth",
      "legend": {
        "alignAsTable": true,
        "avg": true,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": false,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": "total",
        "sortDesc": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.3.7",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": true,
      "steppedLine": false,
      "targets": [
        {
          "expr": "count_over_time({job=\"syslog\"}[$__interval])",
          "legendFormat": "{{host}}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Log Line Counts By Host (Unfiltered)",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "transformations": [],
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "$$hashKey": "object:209",
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "$$hashKey": "object:210",
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "datasource": "${DS_LOKI}",
      "description": "",
      "fieldConfig": {
        "defaults": {
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "semi-dark-orange",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 12,
        "w": 24,
        "x": 0,
        "y": 9
      },
      "id": 4,
      "interval": "$smooth",
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "center",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "7.3.7",
      "targets": [
        {
          "expr": "count_over_time({host=~\"$host\", job=\"syslog\"} [$__interval] |~ \"$free_form_filter\" |~ \"$filter\")",
          "legendFormat": "{{host}}",
          "refId": "A"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Counts By Host ($host) - \"$filter\" - \"$free_form_filter\" (Filtered)",
      "transformations": [],
      "type": "stat"
    },
    {
      "datasource": "${DS_LOKI}",
      "description": "",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "gridPos": {
        "h": 10,
        "w": 24,
        "x": 0,
        "y": 21
      },
      "id": 5,
      "options": {
        "showLabels": true,
        "showTime": true,
        "sortOrder": "Descending",
        "wrapLogMessage": true
      },
      "pluginVersion": "7.3.6",
      "targets": [
        {
          "expr": "{job=\"syslog\", host=~\"$host\"} |~ \"$free_form_filter\" |~ \"$filter\"",
          "legendFormat": "",
          "refId": "A"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Logs By Host - \"$filter\" - \"$free_form_filter\" (Filtered)",
      "type": "logs"
    }
  ],
  "refresh": "30s",
  "schemaVersion": 26,
  "style": "dark",
  "tags": [
    "syslog"
  ],
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {},
        "datasource": "${DS_LOKI}",
        "definition": "label_values(job=\"syslog\", host)",
        "error": {
          "config": {
            "headers": {
              "X-Grafana-Org-Id": 1
            },
            "hideFromInspector": true,
            "retry": 0,
            "url": "api/datasources/proxy/28/loki/api/v1/label/host/values?start=1611331491268000000&end=1611342291268000000"
          },
          "data": {
            "error": "Bad Gateway",
            "message": "Bad Gateway",
            "response": ""
          },
          "message": "Bad Gateway",
          "status": 502,
          "statusText": "Bad Gateway"
        },
        "hide": 0,
        "includeAll": true,
        "label": "Host",
        "multi": false,
        "name": "host",
        "options": [],
        "query": "label_values(job=\"syslog\", host)",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "wap*",
        "type": "query",
        "useTags": true
      },
      {
        "allValue": null,
        "current": {
          "selected": true,
          "tags": [],
          "text": [],
          "value": []
        },
        "error": null,
        "hide": 0,
        "includeAll": true,
        "label": "Filter",
        "multi": true,
        "name": "filter",
        "options": [
          {
            "selected": false,
            "text": "All",
            "value": "$__all"
          },
          {
            "selected": false,
            "text": "info",
            "value": "info"
          },
          {
            "selected": false,
            "text": "debug",
            "value": "debug"
          },
          {
            "selected": false,
            "text": "warn",
            "value": "warn"
          },
          {
            "selected": false,
            "text": "error",
            "value": "error"
          },
          {
            "selected": false,
            "text": "ERR",
            "value": "ERR"
          },
          {
            "selected": false,
            "text": "DNS",
            "value": "DNS"
          },
          {
            "selected": false,
            "text": "auth_failures",
            "value": "auth_failures"
          },
          {
            "selected": false,
            "text": "wpa_auth_failures",
            "value": "wpa_auth_failures"
          }
        ],
        "query": "info,debug,warn,error,ERR,DNS,auth_failures,wpa_auth_failures",
        "queryValue": "",
        "skipUrlSync": false,
        "type": "custom"
      },
      {
        "current": {
          "selected": true,
          "text": "",
          "value": ""
        },
        "error": null,
        "hide": 0,
        "label": "Free Form Filter",
        "name": "free_form_filter",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      },
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "1m",
          "value": "1m"
        },
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Smooth",
        "multi": false,
        "name": "smooth",
        "options": [
          {
            "selected": false,
            "text": "30s",
            "value": "30s"
          },
          {
            "selected": true,
            "text": "1m",
            "value": "1m"
          },
          {
            "selected": false,
            "text": "2m",
            "value": "2m"
          },
          {
            "selected": false,
            "text": "5m",
            "value": "5m"
          },
          {
            "selected": false,
            "text": "10m",
            "value": "10m"
          },
          {
            "selected": false,
            "text": "15m",
            "value": "15m"
          },
          {
            "selected": false,
            "text": "30m",
            "value": "30m"
          },
          {
            "selected": false,
            "text": "1h",
            "value": "1h"
          },
          {
            "selected": false,
            "text": "2h",
            "value": "2h"
          }
        ],
        "query": "30s,1m,2m,5m,10m,15m,30m,1h,2h",
        "queryValue": "",
        "skipUrlSync": false,
        "type": "custom"
      }
    ]
  },
  "time": {
    "from": "now-3h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Loki - Syslog AIO (All In One)",
  "uid": "lux4rd0labs_loki_syslog_aio_01",
  "version": 1,
  "description": "An example dashboard showing Loki ingested syslogs forwarded from syslog-ng. Part of my Loki Syslog All In One project."
}