How can I monitor MSSQL with network traffic the same time with packetbeat?


(Kennedy Kan) #1

I would wonder how can I do that.

Is it a must for me to install logstash in order to do that or I can just directly communicate with elasticsearch?

The folowing is my json file for packetbeat

{
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "analyzed",
"type": "{dynamic_type}"
},
"match": ""
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"client_location": {
"type": "geo_point"
},
"params": {
"index": "analyzed",
"norms": {
"enabled": false
},
"type": "string"
},
"query": {
"doc_values": true,
"index": "analyzed",
"type": "string"
},
"request": {
"index": "analyzed",
"norms": {
"enabled": false
},
"type": "string"
},
"response": {
"index": "analyzed",
"norms": {
"enabled": false
},
"type": "string"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "packetbeat-
"
}


(Steffen Siering) #2

packetbeat does not support MSSQL protocol yet. Related ticket. With packetbeat v5.0 you still can collect flow information (connections made + packets/bytes transferred on network). The default elasticsearch template shipped should be ok.


(system) #3