#/opt/logstash/bin/logstash -t -f /etc/logstash/conf.d/nf Now that we have the logstash configured let's test the configuration file before we start the service. Next we need to download the geoIP database to /etc/logstash: #cd /etc/logstash Note: if you add other options to the elasticsearch output make sure that the user and password options are always the last ones otherwise the logstash will not be able to authenticate into the elasticsearch. The logstash config file is located at /etc/logstash/conf.d/nf. The configuration is comparable with the one from this post with few changes. Now let's configure logstash for accepting logs from filebeats. Now that is done we will need to restart the elasticsearch: #systemctl restart elasticsearch Now that's configured we are ready to create a beats user for the shield: /usr/share/elasticsearch:bin/shield/esusers useradd beats -r logstash -p beatspassword Privileges: indices:data/write/bulk, indices:data/write/delete, indices:data/write/update, indices:data/read/search, indices:data/read/scroll, create_index In order to make different beats packages to connect on elasticsearch I have added all the basic indexes for packetbeats, topbeats and filebeats into the roles.yml under the logstash role which looks like this: logstash:Ĭluster: indices:admin/template/get, indices:admin/template/put The roles for shield are defined at /etc/elasticsearch/shield/roles.yml The -p will set the password for the user you add. The -r option will define the role you add the users to In this scenario we will create an admin user called admin, an user named beat which would be used on logstash to connect to the elasticsearch /usr/share/elasticsearch:bin/shield/esusers useradd admin -r admin -p shieldadmin Once that is done you need to create a series of users with the required roles to it. usr/share/elasticsearch#bin/plugin install shield To do so you will need to navigate to /usr/share/elasticsearch and then run the following commands: /usr/share/elasticsearch#bin/plugin install license To install shield you first need to install license plugin. I will assume that you have elasticsearch 2.x, logstash 2.x and filebeat installed and configured on your system ready to take traffic. The short answer it is that packetbeat does not support https traffic therefore if your site it is under https the packetbeat will not show you exactly the traffic which your website will get. Why we do need filebeat when we have packetbeat? It is a good question. In this post I will show how to install and configure elasticsearch for authentication with shield and configure logstash to get the nginx logs via filebeat and send it to elasticsearch.
0 Comments
Leave a Reply. |