Populating InfluxDB with individual tags and fields from JSON message

Been playing with fail2ban over the past couple of days…and from it managed to get a json formatted mqtt message out on each ban.

{ "ip": "37.49.226.155", "failures": "28", "jail": "ssh", "time": "1591645309.58". "country": "<country"> }

So now I want to get these into influx.

Here is my section…I’ve tried all sorts of combinations. I basically want a table, with tags for the jail (ssh) and ip, with values of the number of failures.

; -----------------------------------------
;             Fail2ban
; -----------------------------------------
[fail2ban/ban]
#topic = fail2ban/ban
targets = influxdb:fail2ban
format  = jail={jail},ip={ip} value={failures}

But nothing I do seems to affect the format. The logs just try sending the entire json string as the value:

2020-06-09 07:41:50,985 DEBUG [connectionpool] http://influxdb:8096 "POST /write?db=network&rp=default&precision=ns HTTP/1.1" 400 219
2020-06-09 07:41:50,987 WARNING [influxdb] POST request failed: (400) {"error":"unable to parse 'fail2ban,topic=fail2ban_ban value={ \"ip\": \"37.49.226.155\", \"failures\": \"28\", \"jail\": \"ssh\", \"time\": \"1591645309.58\". \"country\": \"\u003ccountry\"\u003e }': invalid boolean"}

[psyciknz]

I think this can be closed now also, as I’m running main mqttwarn and not a custom one.

[psyciknz]

So I pulled the latest influxdb code (was able to add it as a quick local service). With this config and the change found by @jacques42:

; -----------------------------------------
;             Fail2ban
; -----------------------------------------
[fail2ban/ban]
topic = fail2ban/ban
targets = log:info, slack:general, influxdb2:fail2ban
format = jail={jail},ip={ip} value={failures}
[fail2ban/unban]
topic = fail2ban/unban
targets = log:info, slack:general, influxdb2:fail2ban
format = jail={jail},ip={ip} value=0

And json of :

 payload: u'{ "ip": "37.49.226.173", "failures": "20", "jail": "ssh", "time": "1591654022.12"}'

I’m now getting entries into a fail2ban table with

time                ip            jail topic        value
----                --            ---- -----        -----
1591654023921039577 37.49.226.173 ssh  fail2ban_ban 20

Which is good enough for me. Unbans go into the same table. with fail2ban_unban. Ideally I’d like it just to say ban an unban, but close enough.

I should merge you latest code into my branch for updates. Since my PR would be well out of date now. (#375)