Hello,
I have to virtualmachine with ubunu 19.10 in my local lab.
Host A: 192.168.29.90
/etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
paths:
- /opt/zeek/logs/current/*.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
tags: ["filebeatzeek"]
setup.kibana:
host: "192.168.29.87:5601"
output.elasticsearch:
hosts: ["192.168.29.87:9200"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
HostB: 192.168.29.87
/etc/elasticsearch/elasticsearch.yml
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: localhost
http.port: 9200
/etc/kibana/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
Check with netstat de network
root@HostB:/home/# netstat -natp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 812/systemd-resolve
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 913/sshd
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 996/nginx: master p
tcp 0 0 0.0.0.0:5601 0.0.0.0:* LISTEN 865/node
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 996/nginx: master p
tcp 0 0 127.0.0.1:50440 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50446 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50438 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50436 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50444 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50442 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50448 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 0 127.0.0.1:50434 127.0.0.1:9200 ESTABLISHED 865/node
tcp 0 196 192.168.29.87:22 192.168.29.10:57736 ESTABLISHED 2270/sshd: usuario
tcp6 0 0 127.0.0.1:9300 :::* LISTEN 2450/java
tcp6 0 0 :::5044 :::* LISTEN 842/java
tcp6 0 0 :::22 :::* LISTEN 913/sshd
tcp6 0 0 127.0.0.1:9600 :::* LISTEN 842/java
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50442 ESTABLISHED 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50436 ESTABLISHED 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50448 ESTABLISHED 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50444 ESTABLISHED 2450/java
tcp6 1 0 127.0.0.1:46854 127.0.0.1:9200 CLOSE_WAIT 842/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50446 ESTABLISHED 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50434 ESTABLISHED 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50440 ESTABLISHED 2450/java
tcp6 0 0 127.0.0.1:9200 127.0.0.1:50438 ESTABLISHED 2450/java
Check the comunication front A > to B.
root@HostA:/home/# sudo filebeat setup
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://192.168.29.87:9200: Get http://192.168.29.87:9200: dial tcp 192.168.29.87:9200: connect: connection refused]
root@HostA:/home/# nc -vn 192.168.29.87 9200
nc: connect to 192.168.29.87 port 9200 (tcp) failed: Connection refused
root@HostA:/home/# nc -vn 192.168.29.87 5601
Connection to 192.168.29.87 5601 port [tcp/*] succeeded!
check on HostB witch curl
root@hostB:/home/usuario# curl -X GET "localhost:9200/?pretty"
{
"name" : "hostb",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "RpVuwifoQEqgbEPAtu_0ow",
"version" : {
"number" : "7.5.0",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "e9ccaed468e2fac2275a3761849cbee64b39519f",
"build_date" : "2019-11-26T01:06:52.518245Z",
"build_snapshot" : false,
"lucene_version" : "8.3.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
....................................
check on HostA witch curl
root@hostA:/home/# curl -X GET "192.168.29.87:9200/?pretty"
curl: (7) Failed to connect to 192.168.29.87 port 9200: Connection refused
Other information:
- ELK version: 7.5
- SO: ubuntu 19.10
- Firewall: none
What I can change to resolve the wrong situation and send data to HostA to HostB using elasticsearch?
Why I can connect to 9200 on localhost but I can't from remote host?
How I can confire elasticsearch to listen from the port 9200 from all remote ips?
I am try to deploy Zeek (SIEM) from the "Getting Started" to use "Zeek logs". Hosta is Zeek, and HostB is ELK.
Thank