How to Monitor VPN Usage with ELK Stack (Elasticsearch, Logstash, Kibana)

Monitoring VPN usage is critical for both security and performance analysis. The ELK stack—comprising Elasticsearch, Logstash, and Kibana—provides an ideal solution for aggregating, processing, and visualizing VPN logs. This guide demonstrates how to implement an effective VPN usage monitoring system using the ELK stack.

Prerequisites

Elasticsearch 7.x or higher installed and running.
Logstash 7.x or higher installed and running.
Kibana 7.x or higher installed and running.
Access to VPN logs (e.g., OpenVPN, WireGuard, or similar systems).
Basic knowledge of the ELK stack and VPN infrastructure.

Configuring Logstash to Ingest VPN Logs

The first step is to configure Logstash to parse and ingest the VPN logs. Logstash will act as the bridge between your VPN log files and Elasticsearch, processing the log data before storing it in an Elasticsearch index.

Create a Logstash configuration file (e.g., vpn_logstash.conf) with the following content:

input {
  file {
    path => "/var/log/openvpn/*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

filter {
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{IPV4:client_ip} %{GREEDYDATA:message}" }
  }

  date {
    match => [ "timestamp", "ISO8601" ]
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "vpn-logs-%{+YYYY.MM.dd}"
  }
}

This configuration sets Logstash to read log files from the OpenVPN directory, parse each log entry using a grok pattern, and send the structured data to Elasticsearch under a dynamically named index.

Verifying Logstash Input and Output

Once Logstash is configured, start the Logstash service:

sudo systemctl start logstash

Check if Logstash is receiving and processing logs by examining the Elasticsearch index:

curl -X GET "localhost:9200/vpn-logs-*/_search?pretty"

This command should return a JSON response with documents from the vpn-logs-* index, confirming that logs are being ingested correctly.

Visualizing VPN Data in Kibana

After your logs are ingested into Elasticsearch, you can begin visualizing the data in Kibana. Kibana’s powerful dashboard allows you to create meaningful visualizations for VPN usage patterns, such as user activity, connection duration, and geographical distribution.

To get started, navigate to the Kibana dashboard and create an index pattern for the VPN logs:

Open Kibana and go to the “Management” section.
Select “Index Patterns” and click “Create index pattern”.
Enter vpn-logs-* as the index pattern.
Choose the timestamp field for time filtering and save the pattern.

Creating Visualizations in Kibana

Once the index pattern is set up, you can start creating visualizations. Some useful visualizations include:

Line charts to track VPN usage over time.
Pie charts to visualize the distribution of VPN connections by client IP address.
Geographical maps to display the location of VPN clients based on IP geolocation.

To create a line chart showing VPN usage over time, follow these steps:

Navigate to the “Visualize” section in Kibana.
Select “Line Chart” from the available visualization types.
Choose the “Date Histogram” aggregation for the X-axis and select the timestamp field.
Set the Y-axis aggregation to “Count” to show the number of VPN connections over time.
Click “Save” and name your visualization (e.g., “VPN Usage Over Time”).

Setting Up Dashboards in Kibana

After creating visualizations, you can combine them into a dashboard for a comprehensive view of VPN usage. A sample VPN usage dashboard could include:

Line charts for active connections over time.
Bar charts for top 10 VPN clients by IP address.
Geo maps showing connection origins.

To create a dashboard, navigate to the “Dashboard” section, click “Create new dashboard,” and add the visualizations you’ve created. Save the dashboard and share it with your team for real-time monitoring.

Advanced Analytics with Kibana

For advanced monitoring, consider adding custom queries in Kibana’s Discover or Timelion tools to track specific VPN events, such as login failures or data transfer anomalies. Use Elasticsearch query syntax for filtering logs based on specific keywords or patterns.

For example, to track failed login attempts, you could filter logs using the keyword “authentication failed” in the message field:

GET /vpn-logs-*/_search
{
  "query": {
    "match": {
      "message": "authentication failed"
    }
  }
}

This query will return all logs related to authentication failures, allowing you to track and respond to potential security threats.

We earn commissions using affiliate links.