How to Monitor Fail2Ban Logs on ELK Stack

# Create Fail2Ban Patterns
$ mkdir /etc/logstash/patterns
$ cat /etc/logstash/patterns/fail2ban
F2B_DATE %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[ ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})
F2B_ACTION (\w+)\.(?:\w+)(\s+)?\:
F2B_JAIL \[(?<jail>\w+\-?\w+?)\]
F2B_LEVEL (?<level>\w+)\s+

# Create Logstash configuration file
$ vim /etc/logstash/conf.d/fail2ban.conf
input {
  file {
    type => "fail2ban"
    start_position => "beginning"
    path => [ "/var/log/fail2ban.log" ]
  }
}

filter {
  if [type] == "fail2ban" {
    grok {
      patterns_dir => "/etc/logstash/patterns"
      match => [
        "message", "%{F2B_DATE:date} %{F2B_ACTION} %{WORD:level} %{F2B_JAIL} %{WORD:action} %{IP:ip}",
        "message", "%{F2B_DATE:date} %{F2B_ACTION} %{F2B_LEVEL} %{GREEDYDATA:msg}?"
      ]
    }

    geoip {
      source => "ip"
    }
  }
}

# Temp Fix
$ chmod 644 /var/log/fail2ban.log

# Permeant Fix
$ cat /etc/logrotate.d/Fail2Ban
/var/log/fail2ban.log {

    weekly
    rotate 4
    compress

    delaycompress
    missingok
    postrotate
	   fail2ban-client set logtarget /var/log/fail2ban.log >/dev/null
    endscript

    # If fail2ban runs as non-root it still needs to have write access
    # to logfiles.
    # create 644 fail2ban adm
    create 644 root adm
}

$ sudo service logstash restart