Best way to put pcap traffic into logstash/Elasticsearch

[nuggetinu]

Hi,

I am interested in creating a dashboard which will visualize network traffic collected from access points. I currently have tcpdump running on an access point and outputting to a pcap file. My intention is to pcap data to ELK.

Can someone provide me some guides on how to do this in seamless manner? Eventually I would eliminate Kibana and use my dasboard implemented through unity3d.

Appreciate suggestions on how to successfully put the pcap data into ELK. I currently heard about packetbeat.

Thanks in advance.

[warkolm (Mark Walkom)]

Is https://www.elastic.co/guide/en/beats/packetbeat/5.6/capturing-options.html useful?

[nuggetinu]

Blockquote Is Setting Traffic Capturing Options | Packetbeat Reference [5.6] | Elastic useful?

Hi Mark,

Thanks for the feedback.

I'm worried about packetbeat for 2 things:

1. Packetbeat does correlation of the requests with the responses, and inserts a single document per request-response pair in ES. Although, this is generally good as it's a lot more convenient to have them correlated once in ES, this can be problematic if I want to test the setup using offline pcap files.

2. While I can use Packetbeat to read the packets from a pcap file, its implementation assumes that the packets are read in real time, which can cause some issues with timeout transactions (the time is measured from the current time, not from the initial packet's time).

Thus, I am looking for possible alternatives.

Blockquote