A dashboard for OPNSense filterlog data via Alloy and Loki

Find a file

StarkZarn ce16b2702d remove shields.io download counter		2026-02-10 16:55:33 +00:00
LICENSE	I cannot copy/paste. Update license to correct GPLv3.	2025-05-04 17:06:30 -07:00
opnsense-filterlog-dashboard.json	Fix: match geoip field names between loki and dashboard	2025-10-12 14:33:45 -07:00
README.md	remove shields.io download counter	2026-02-10 16:55:33 +00:00

README.md

OPNSense Filterlog Firewall Dashboard (Grafana)

This repository contains a Grafana dashboard JSON export for visualizing OPNSense firewall traffic logs (filterlog) with GeoIP enrichment. It accompanies my blog post on how to collect, enrich, and visualize OPNSense logs using Grafana Alloy and Loki as the data source.

📊 Dashboard Overview

This basic dashboard includes:

Source and destination IP visualizations
GeoIP-resolved locations with world map panels
Firewall action summaries (pass/block)
Protocol and port breakdowns
Time-series charts for traffic volume

Ideal for anyone running OPNSense who wants deeper insight into network activity with geographical context.

🔧 Requirements

To use this dashboard, ensure you have the following setup:

Grafana (v8+ recommended)
Grafana Alloy as the data source for Grafana (for log aggregation and analysis)
Loki as the log aggregator to collect OPNSense filterlog data
GeoIP enrichment via your log pipeline in Loki (again, see the blog post )
Grafana worldmap plugin (if using geo panels)

🚀 Getting Started

Clone this repository or download the opnsense_filterlog_dashboard.json file.
Open Grafana and go to Dashboards > Import.
Upload the JSON file or paste its content.
Select Loki as your data source when prompted.
Click Import to add the dashboard.

See the full guide on how to collect, enrich, and visualize OPNSense logs with GeoIP and Grafana:

👉 My Blog Post: Monitoring OPNSense Logs with Grafana Loki

📝 Notes

Based heavily on the work of extremempd. Thank you!

🛡️ License

GPLv3 License. See LICENSE for details.