Dashboard
Your ext. IP:
Loading...
Filter Debug
Filter content is shown read-only. Click 'Edit' to modify for testing. Changes are temporary and not saved.
Please authenticate to access the management interface
Redirecting to login...
Secure authentication via OpenID Connect
Filter content is shown read-only. Click 'Edit' to modify for testing. Changes are temporary and not saved.
Edit the filter regex below for testing. Changes are temporary and not saved.
-v /var/log:/var/log:ro ) this is required so that the fail2ban-ui can verify logpath variables or paths when updating jails.
Only alphanumeric characters, dashes, and underscores are allowed.
Selecting a filter will auto-populate the jail configuration.
Jail configuration will be auto-populated when you select a filter.
Only alphanumeric characters, dashes, and underscores are allowed.
If left empty, an empty filter file will be created.
Register remote Fail2ban instances and choose how the UI connects to them.
Edit an existing server from the list, or create a new connector by clicking the button above.
Jail:
Threat intelligence data for this IP.
Country distribution and recurring offenders.
Drag on the chart to zoom into a time range.
Pin two incidents to compare their IPs.
Top origins for the selected time range.
IP addresses repeatedly triggering Fail2ban.
Drag to rotate, scroll to zoom.
The default data stream works without it. The template keeps the built-in logs settings and lifecycle and adds exact types for the Fail2ban, log and WHOIS fields. Run it in Kibana Dev Tools before the first event:
PUT _index_template/logs-fail2ban_ui.events
{
"index_patterns": ["logs-fail2ban_ui.events-*"],
"data_stream": {},
"priority": 200,
"composed_of": ["logs@mappings", "logs@settings", "logs@custom", "logs-fail2ban_ui.events@custom", "ecs@mappings"],
"ignore_missing_component_templates": ["logs@custom", "logs-fail2ban_ui.events@custom"],
"template": {
"mappings": {
"properties": {
"@timestamp": { "type": "date" },
"event.kind": { "type": "keyword" },
"event.type": { "type": "keyword" },
"event.action": { "type": "keyword" },
"source.ip": { "type": "ip" },
"source.address": { "type": "keyword" },
"source.port": { "type": "integer" },
"source.user.name": { "type": "keyword" },
"source.geo.country_iso_code": { "type": "keyword" },
"observer.hostname": { "type": "keyword" },
"server.address": { "type": "keyword" },
"http.request.method": { "type": "keyword" },
"http.response.status_code": { "type": "integer" },
"http.response.body.bytes": { "type": "long" },
"http.request.referrer": { "type": "keyword" },
"http.version": { "type": "keyword" },
"url.original": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 1024 }}},
"url.path": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 1024 }}},
"url.query": { "type": "text" },
"user_agent.original": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 512 }}},
"process.name": { "type": "keyword" },
"process.pid": { "type": "integer" },
"log.timestamp": { "type": "keyword" },
"log.level": { "type": "keyword" },
"log.syslog.hostname": { "type": "keyword" },
"message": { "type": "text" },
"fail2ban.jail": { "type": "keyword" },
"fail2ban.failures": { "type": "keyword" },
"fail2ban.whois": { "type": "text" },
"fail2ban.logs": { "type": "text" },
"fail2ban.parsed_logs": {
"type": "nested",
"properties": {
"log.original": { "type": "text" },
"log.timestamp": { "type": "keyword" },
"server.address": { "type": "keyword" },
"source.address": { "type": "keyword" },
"source.user.name": { "type": "keyword" },
"source.port": { "type": "integer" },
"http.request.method": { "type": "keyword" },
"http.response.status_code": { "type": "integer" },
"http.response.body.bytes": { "type": "long" },
"http.version": { "type": "keyword" },
"url.original": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 1024 }}},
"user_agent.original": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 512 }}},
"log.level": { "type": "keyword" },
"message": { "type": "text" }
}
},
"whois.net_range": { "type": "keyword" },
"whois.cidr": { "type": "keyword" },
"whois.net_name": { "type": "keyword" },
"whois.org_name": { "type": "text", "fields": { "keyword": { "type": "keyword" }}},
"whois.org_id": { "type": "keyword" },
"whois.country": { "type": "keyword" },
"whois.abuse_email": { "type": "keyword" },
"whois.abuse_phone": { "type": "keyword" },
"whois.asn": { "type": "keyword" },
"whois.registration_date": { "type": "keyword" },
"whois.updated_date": { "type": "keyword" }
}
}
}
}
Fail2ban-UI sends ECS-compatible documents with automatic log and WHOIS enrichment. Log lines are parsed via grok patterns (Apache, Nginx, sshd, Postfix, etc.) and WHOIS text is extracted into structured fields. Each event is written to the data stream logs-fail2ban_ui.events-default:
{
"@timestamp": "2026-03-05T12:00:00Z",
"event.kind": "alert",
"event.type": "ban",
"event.action": "http_request",
"source.ip": "1.2.3.4",
"source.geo.country_iso_code": "CH",
"observer.hostname": "webserver-01",
"fail2ban.jail": "sshd",
"fail2ban.failures": "5",
"fail2ban.whois": "... (raw text) ...",
"fail2ban.logs": "... (raw text) ...",
"data_stream.type": "logs",
"data_stream.dataset": "fail2ban_ui.events",
"data_stream.namespace": "default",
"server.address": "code.example.com",
"source.address": "1.2.3.4",
"http.request.method": "GET",
"http.response.status_code": 301,
"url.original": "/.git/config?foo=bar",
"url.path": "/.git/config",
"url.query": "foo=bar",
"user_agent.original": "Mozilla/5.0 ...",
"process.name": "httpd",
"log.timestamp": "05/Mar/2026:12:00:00 +0100",
"whois.org_name": "Swissmakers GmbH",
"whois.country": "CH",
"whois.abuse_email": "abuse@example.com",
"whois.asn": "200373",
"whois.cidr": "1.1.1.0/24"
}
Use an API key (preferred) or basic auth with a user that has the create_doc and auto_configure privileges on logs-fail2ban_ui.events-*. Create an API key in Kibana under Stack Management → API Keys.
Save the Fail2ban-UI settings and click Test Connection. The test event creates the data stream if it does not exist yet.
In Kibana, go to Stack Management → Data Views → Create data view. Use logs-fail2ban_ui.events-* as name and index pattern and select @timestamp as the time field.
In Kibana, go to Discover and select the logs-fail2ban_ui.events-* data view. The first event appears there.