Filebeat v7.3 or above for FreeBSD to collect Bro/Zeek Log

Elastic Stack Beats
1

Anyone know how to install the lastest version v7.6.0 on freeBSD?
I have a pfsense 2.4.5 with zeek log installed on it and want to ship log to ES Siem
I tried the instruction: https://blog.securitybits.io/2019/12/beats-7.5.0-on-pfsense-2.4.4/
but got error:

# cd filebeat/
# gmake
go build -ldflags "-X github.com/elastic/beats/libbeat/version.buildTime=2020-05-18T08:05:30Z -X github.com/elastic/beats/libbeat/version.commit=6a23e8f8f30f5001ba344e                                        4e54d8d9cb82cb107c"
# github.com/elastic/beats/vendor/github.com/DataDog/zstd
exec: "clang": executable file not found in $PATH
# github.com/elastic/beats/vendor/github.com/elastic/gosigar
exec: "clang": executable file not found in $PATH
gmake: *** [../libbeat/scripts/Makefile:121: filebeat] Error 2

If you have any solution please share with me.
Thanks a lots

2

I've tested and couldn't reproduce.
I tested version 7.6.2

# ./filebeat version
  filebeat version 7.6.2 (amd64), libbeat 7.6.2 [d57bcf8684602e15000d65b75afcd110e2b12b59 built 2020-05-29 23:12:54 +0000 UTC]

and 7.7.0


# ./filebeat version
  filebeat version 7.7.0 (amd64), libbeat 7.7.0 [unknown built unknown]

What FreeBSD version are you using?
sysctl -n kern.osrelease kern.ostype
I used FreeBSD 11:

  11.3-RELEASE
   FreeBSD

I installed zeek as well and it works to use zeek module.
Maybe you can install
If you still had issues, please reach out again.
Did you install the correct packages?

pkg install git gmake go bash
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.