# Elasticsearch Collerator

**URL:** <https://discuss.elastic.co/t/elasticsearch-collerator/46960>\
**Category:** Elasticsearch\
**Created:** [April 11, 2016, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-collerator/46960 "2016-04-11T08:32:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ilam](https://avatars.discourse-cdn.com/v4/letter/i/f07891/32.png) [@Ilam](https://discuss.elastic.co/u/Ilam)\
**Post date:** [April 11, 2016, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-collerator/46960/1 "2016-04-11T08:32:21Z")

</div>

Hello,  
I installed ELK, sending logs to ElasticSearch and display the results on Kibana.  
But I do not know how to correlate the information.  
What do you use how free tool for correlation? I tried Watcher, but he is paying. I also tested SEC, but I can only take data .txt files but no ElasticSearch, ie localhost: 9200.  
Thank you in advance for your help,  
Ilan

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 11, 2016, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-collerator/46960/2 "2016-04-11T08:34:08Z")

</div>

What sort of correlation?  
Have you seen [https://github.com/elastic/timelion](https://github.com/elastic/timelion)?

---

<div class="post-metadata">

**Author:** ![Ilam](https://avatars.discourse-cdn.com/v4/letter/i/f07891/32.png) [@Ilam](https://discuss.elastic.co/u/Ilam)\
**Post date:** [April 11, 2016, 8:57am UTC](https://discuss.elastic.co/t/elasticsearch-collerator/46960/3 "2016-04-11T08:57:22Z")

</div>

Thank you for your answer warkolm. I do not know Timelion, I'll watch what he does.

Otherwise, I use Juniper and Cisco input logs. And I try to correlate attack bruteforce, admin login, port scans, connections from unknown IP ... There is no correlation module in Kibana by conséquant, I'm confused.

---

<div class="post-metadata">

**Author:** ![Ilam](https://avatars.discourse-cdn.com/v4/letter/i/f07891/32.png) [@Ilam](https://discuss.elastic.co/u/Ilam)\
**Post date:** [April 13, 2016, 10:34am UTC](https://discuss.elastic.co/t/elasticsearch-collerator/46960/4 "2016-04-13T10:34:45Z")

</div>

How to connect SEC with ElasticSearch? Or what tool do you use for correlations?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-collerator/46960/5 "2017-07-05T22:59:38Z")

</div>