Suspicious Attempt
Suspicious Attempts to Sonicwall Firewall
Log file sent to rsyslog, upload to elasticsearch using custom logstash (7.5.0) and visualized using Grafana 6.6.2
Sonicwall Firewall -> Centralized Syslog -> Logstash -> Elasticsearch -> Grafana
{
  "__inputs": [
    {
      "name": "DS_LOGSTASH",
      "label": "Logstash",
      "description": "Custom filter for Sonicwall syslog file",
      "type": "datasource",
      "pluginId": "elasticsearch",
      "pluginName": "Elasticsearch"
    }
  ],
  "__requires": [
    {
      "type": "panel",
      "id": "briangann-datatable-panel",
      "name": "Datatable Panel",
      "version": "0.0.9"
    },
    {
      "type": "datasource",
      "id": "elasticsearch",
      "name": "Elasticsearch",
      "version": "1.0.0"
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "6.6.2"
    },
    {
      "type": "panel",
      "id": "grafana-piechart-panel",
      "name": "Pie Chart",
      "version": "1.4.0"
    },
    {
      "type": "panel",
      "id": "grafana-worldmap-panel",
      "name": "Worldmap Panel",
      "version": "0.2.1"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": ""
    },
    {
      "type": "panel",
      "id": "michaeldmoore-annunciator-panel",
      "name": "Annunciator",
      "version": "1.0.2"
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "gnetId": 11836,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "panels": [
    {
      "alert": {
        "alertRuleTags": {},
        "conditions": [
          {
            "evaluator": {
              "params": [
                2
              ],
              "type": "gt"
            },
            "operator": {
              "type": "and"
            },
            "query": {
              "params": [
                "A",
                "5m",
                "now"
              ]
            },
            "reducer": {
              "params": [],
              "type": "sum"
            },
            "type": "query"
          }
        ],
        "executionErrorState": "alerting",
        "for": "2m",
        "frequency": "30s",
        "handler": 1,
        "name": "Suspicious Activity alert",
        "noDataState": "keep_state",
        "notifications": [
          {
            "uid": "FWxBgR8Wk"
          }
        ]
      },
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_LOGSTASH}",
      "decimals": 2,
      "fill": 2,
      "fillGradient": 0,
      "gridPos": {
        "h": 14,
        "w": 17,
        "x": 0,
        "y": 0
      },
      "hiddenSeries": false,
      "id": 2,
      "legend": {
        "alignAsTable": true,
        "avg": true,
        "current": false,
        "max": true,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": "total",
        "sortDesc": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": true,
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sonicwall.source.ip",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sonicwall.source.geoip.city_name.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sonicwall.source.geoip.country_name.keyword",
              "id": "6",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sonicwall.hostname",
              "id": "7",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sonicwall.username",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "1m",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "sonicwall.handshake.message: CLI AND (NOT (sonicwall.source.ip.keyword: 10.*))",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [
        {
          "colorMode": "critical",
          "fill": true,
          "line": true,
          "op": "gt",
          "value": 2
        }
      ],
      "timeFrom": null,
      "timeRegions": [
        {
          "colorMode": "green",
          "fill": true,
          "fillColor": "rgba(234, 112, 112, 0.12)",
          "from": "08:00",
          "line": false,
          "lineColor": "rgba(237, 46, 24, 0.60)",
          "op": "time",
          "to": "18:00"
        },
        {
          "colorMode": "gray",
          "fill": true,
          "fillColor": "rgba(234, 112, 112, 0.12)",
          "from": "18:00",
          "line": false,
          "lineColor": "rgba(237, 46, 24, 0.60)",
          "op": "time",
          "to": "08:00"
        },
        {
          "colorMode": "yellow",
          "fill": true,
          "fillColor": "rgba(234, 112, 112, 0.12)",
          "fromDayOfWeek": 6,
          "line": false,
          "lineColor": "rgba(237, 46, 24, 0.60)",
          "op": "time",
          "toDayOfWeek": 7
        }
      ],
      "timeShift": null,
      "title": "Suspicious Activity",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "Attempt",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "LowerLimit": {
        "Color": "#56A64B",
        "Decimals": 0,
        "DisplayOption": "static",
        "FontSize": "50%",
        "Value": "10"
      },
      "LowerWarning": {
        "Color": "#96D98D",
        "DisplayOption": "static",
        "Value": 25
      },
      "Metric": {
        "Color": "#FFB357",
        "Decimals": 0,
        "FontSize": "100%",
        "Format": "none",
        "Name": "total"
      },
      "MetricValueRange": "25 -> 950",
      "Postfix": {
        "FontSize": "50%",
        "Text": "attempts"
      },
      "Prefix": {
        "FontSize": "50%",
        "Text": "Total Suspicious Activities"
      },
      "UpperLimit": {
        "Color": "#C4162A",
        "Decimals": 0,
        "DisplayOption": "flash",
        "FontSize": "50%",
        "Value": "1000"
      },
      "UpperWarning": {
        "Color": "#F2495C",
        "DisplayOption": "flash",
        "Value": "950"
      },
      "datasource": "${DS_LOGSTASH}",
      "gridPos": {
        "h": 6,
        "w": 7,
        "x": 17,
        "y": 0
      },
      "id": 14,
      "options": {},
      "sparkline": {
        "fillColor": "#E02F44",
        "full": false,
        "lineColor": "rgb(145, 200, 16)",
        "show": true
      },
      "targets": [
        {
          "bucketAggs": [
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "30s",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "sonicwall.handshake.message: CLI  AND NOT sonicwall.source.ip: \"10.0.0.0/8\"",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Suspicious Activities Annunciator",
      "transparent": true,
      "type": "michaeldmoore-annunciator-panel"
    },
    {
      "datasource": "${DS_LOGSTASH}",
      "gridPos": {
        "h": 4,
        "w": 7,
        "x": 17,
        "y": 6
      },
      "id": 12,
      "options": {
        "colorMode": "background",
        "fieldOptions": {
          "calcs": [
            "max"
          ],
          "defaults": {
            "mappings": [],
            "thresholds": {
              "mode": "absolute",
              "steps": [
                {
                  "color": "green",
                  "value": null
                }
              ]
            }
          },
          "overrides": [],
          "values": false
        },
        "graphMode": "none",
        "justifyMode": "center",
        "orientation": "auto"
      },
      "pluginVersion": "6.6.2",
      "targets": [
        {
          "bucketAggs": [
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "20m",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "sonicwall.wan.ip",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "cardinality"
            }
          ],
          "query": "",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Router Connected",
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": "${DS_LOGSTASH}",
      "gridPos": {
        "h": 4,
        "w": 7,
        "x": 17,
        "y": 10
      },
      "id": 10,
      "options": {
        "colorMode": "background",
        "fieldOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "defaults": {
            "mappings": [],
            "thresholds": {
              "mode": "absolute",
              "steps": [
                {
                  "color": "green",
                  "value": null
                },
                {
                  "color": "red",
                  "value": 25
                }
              ]
            },
            "title": "",
            "unit": "none"
          },
          "overrides": [],
          "values": false
        },
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto"
      },
      "pluginVersion": "6.6.2",
      "targets": [
        {
          "bucketAggs": [
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "10m",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "sonicwall.handshake.message: \"login denied due to bad credentials\"",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Current Login Denied",
      "transparent": true,
      "type": "stat"
    },
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": "0.003"
      },
      "datasource": "${DS_LOGSTASH}",
      "decimals": null,
      "fontSize": "80%",
      "format": "short",
      "gridPos": {
        "h": 14,
        "w": 12,
        "x": 0,
        "y": 14
      },
      "id": 4,
      "interval": null,
      "legend": {
        "header": "Total Attempts",
        "percentage": true,
        "percentageDecimals": 2,
        "show": true,
        "sideWidth": null,
        "sort": "total",
        "sortDesc": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 3,
      "nullPointMode": "connected",
      "options": {},
      "pieType": "donut",
      "strokeWidth": 1,
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sonicwall.username",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sonicwall.source.ip",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sonicwall.source.geoip.city_name.keyword",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "1m",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "sonicwall.username: * AND NOT sonicwall.source.ip: \"10.0.0.0/8\" AND sonicwall.handshake.message: CLI*",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Suspicious Attempt using user from Internet",
      "transparent": true,
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "circleMaxSize": "10",
      "circleMinSize": 2,
      "colors": [
        "#73BF69",
        "rgba(237, 129, 40, 0.89)",
        "#F2495C"
      ],
      "datasource": "${DS_LOGSTASH}",
      "decimals": 0,
      "esGeoPoint": "sonicwall.source.geoip.location",
      "esLocationName": "sonicwall.source.geoip.city_name.keyword",
      "esMetric": "Count",
      "gridPos": {
        "h": 14,
        "w": 12,
        "x": 12,
        "y": 14
      },
      "hideEmpty": false,
      "hideZero": false,
      "id": 6,
      "initialZoom": "2",
      "locationData": "geohash",
      "mapCenter": "(0°, 0°)",
      "mapCenterLatitude": 0,
      "mapCenterLongitude": 0,
      "maxDataPoints": 1,
      "mouseWheelZoom": false,
      "options": {},
      "showLegend": true,
      "stickyLabels": true,
      "tableQueryOptions": {
        "geohashField": "geohash",
        "latitudeField": "latitude",
        "longitudeField": "longitude",
        "metricField": "metric",
        "queryType": "geohash"
      },
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sonicwall.source.geoip.city_name.keyword",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "sonicwall.source.geoip.location",
              "id": "2",
              "settings": {
                "precision": 3
              },
              "type": "geohash_grid"
            }
          ],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "sonicwall.username: * AND NOT sonicwall.source.ip: \"10.0.0.0/8\" AND sonicwall.handshake.message: CLI*",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": "15,30",
      "timeFrom": null,
      "timeShift": null,
      "title": "Suspicious Attempt Source City",
      "transparent": true,
      "type": "grafana-worldmap-panel",
      "unitPlural": "",
      "unitSingle": "",
      "valueName": "total"
    },
    {
      "columnAliases": [
        {
          "alias": "Timestamp",
          "name": "@timestamp"
        },
        {
          "alias": "Source IP",
          "name": "sonicwall.source.ip"
        },
        {
          "alias": "Source Country",
          "name": "sonicwall.source.geoip.country_code2"
        },
        {
          "alias": "Source City",
          "name": "sonicwall.source.geoip.city_name"
        },
        {
          "alias": "Username",
          "name": "sonicwall.username"
        },
        {
          "alias": "Depo",
          "name": "sonicwall.serialnum"
        },
        {
          "alias": "Connection Message",
          "name": "sonicwall.handshake.message"
        },
        {
          "alias": "Source Country Name",
          "name": "sonicwall.source.geoip.country_name"
        },
        {
          "alias": "Sonicwall IP Internal",
          "name": "sonicwall.hostname"
        },
        {
          "alias": "WAN IP",
          "name": "sonicwall.wan.ip"
        }
      ],
      "columnWidthHints": [],
      "columns": [
        {
          "text": "@timestamp",
          "value": "@timestamp"
        },
        {
          "text": "sonicwall.source.ip",
          "value": "sonicwall.source.ip"
        },
        {
          "text": "sonicwall.source.geoip.country_code2",
          "value": "sonicwall.source.geoip.country_code2"
        },
        {
          "text": "sonicwall.source.geoip.city_name",
          "value": "sonicwall.source.geoip.city_name"
        },
        {
          "text": "sonicwall.source.geoip.country_name",
          "value": "sonicwall.source.geoip.country_name"
        },
        {
          "text": "sonicwall.username",
          "value": "sonicwall.username"
        },
        {
          "text": "sonicwall.serialnum",
          "value": "sonicwall.serialnum"
        },
        {
          "text": "sonicwall.hostname",
          "value": "sonicwall.hostname"
        },
        {
          "text": "sonicwall.wan.ip",
          "value": "sonicwall.wan.ip"
        },
        {
          "text": "sonicwall.handshake.message",
          "value": "sonicwall.handshake.message"
        }
      ],
      "compactRowsEnabled": true,
      "datasource": "${DS_LOGSTASH}",
      "datatablePagingType": "full_numbers",
      "datatableTheme": "basic_theme",
      "emptyData": false,
      "fontSize": "100%",
      "gridPos": {
        "h": 30,
        "w": 24,
        "x": 0,
        "y": 28
      },
      "hoverEnabled": true,
      "id": 8,
      "infoEnabled": true,
      "lengthChangeEnabled": true,
      "options": {},
      "orderColumnEnabled": true,
      "pagingTypes": [
        {
          "text": "Page number buttons only",
          "value": "numbers"
        },
        {
          "text": "'Previous' and 'Next' buttons only",
          "value": "simple"
        },
        {
          "text": "'Previous' and 'Next' buttons, plus page numbers",
          "value": "simple_numbers"
        },
        {
          "text": "'First', 'Previous', 'Next' and 'Last' buttons",
          "value": "full"
        },
        {
          "text": "'First', 'Previous', 'Next' and 'Last' buttons, plus page numbers",
          "value": "full_numbers"
        },
        {
          "text": "'First' and 'Last' buttons, plus page numbers",
          "value": "first_last_numbers"
        }
      ],
      "panelHeight": null,
      "rowNumbersEnabled": false,
      "rowsPerPage": 25,
      "scroll": false,
      "scrollHeight": "default",
      "searchEnabled": true,
      "showCellBorders": false,
      "showHeader": true,
      "showRowBorders": false,
      "sort": {
        "col": 0,
        "desc": true
      },
      "sortByColumns": [
        {
          "columnData": 0,
          "sortMethod": "desc"
        }
      ],
      "sortByColumnsData": [
        [
          0,
          "desc"
        ]
      ],
      "stripedRowsEnabled": false,
      "styles": [
        {
          "dateFormat": "YYYY-MM-DD HH:mm:ss TZ",
          "pattern": "@timestamp",
          "type": "date"
        },
        {
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "decimals": 2,
          "pattern": "sonicwall.source.ip",
          "splitPattern": "/ /",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sonicwall.source.geoip.country_code2",
          "splitPattern": "/ /",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sonicwall.source.geoip.city_name",
          "splitPattern": "/ /",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sonicwall.username",
          "splitPattern": "/ /",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "column": "sonicwall.serialnum",
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sonicwall.serialnum",
          "sanitize": true,
          "splitPattern": "/ /",
          "thresholds": [],
          "type": "string",
          "unit": "short",
          "valueMaps": []
        }
      ],
      "targets": [
        {
          "bucketAggs": [],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "meta": {},
              "settings": {
                "size": 10000
              },
              "type": "raw_document"
            }
          ],
          "query": "sonicwall.handshake.message: CLI AND NOT sonicwall.source.ip: (\"10.0.0.0/8\" OR \"36.0.0.0/8\")",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "themeOptions": {
        "dark": "./styles/dark.css",
        "light": "./styles/light.css"
      },
      "themes": [
        {
          "disabled": false,
          "text": "Basic",
          "value": "basic_theme"
        },
        {
          "disabled": true,
          "text": "Bootstrap",
          "value": "bootstrap_theme"
        },
        {
          "disabled": true,
          "text": "Foundation",
          "value": "foundation_theme"
        },
        {
          "disabled": true,
          "text": "ThemeRoller",
          "value": "themeroller_theme"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Suspicious Attempt Log",
      "transform": "json",
      "transparent": true,
      "type": "briangann-datatable-panel"
    }
  ],
  "refresh": "5m",
  "schemaVersion": 22,
  "style": "dark",
  "tags": [
    "OK"
  ],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timepicker": {
    "hidden": false,
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ]
  },
  "timezone": "",
  "title": "Suspicious Attempt",
  "uid": "bzjteeyZz",
  "version": 75,
  "description": "Suspicious Attempts to Sonicwall Firewall\r\nLog file sent to rsyslog, upload to elasticsearch using custom logstash (7.5.0) and visualized using Grafana 6.6.2"
}