# How do I adding Suricata events to Elasticsearch

**URL:** <https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827>\
**Category:** SIEM\
**Created:** [April 5, 2024, 2:10am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827 "2024-04-05T02:10:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![rayobe4014](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@rayobe4014](https://discuss.elastic.co/u/rayobe4014)\
**Post date:** [April 5, 2024, 2:10am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/1 "2024-04-05T02:10:39Z")

</div>

I just configuration Exebox with Elasticsearch and Suricata but Elasticsearch not get event from Suricata so how can I add Suricata event to Elasticsearch ?  
Please guide me how to add Suricata event to Elasticsearch.  
Best regards,

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 5, 2024, 2:18am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/2 "2024-04-05T02:18:01Z")

</div>

Hi @rayobe4014 Welcome to the community...

Perhaps take a look at the following

Filebeat quickstart just substitute the suricata module... follow the steps exactly

> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html)**

The module

> **[Suricata module | Filebeat Reference \[8.13\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-suricata.html)**

Some help here

> [@Filebeat Suricata Module "module suricata is configured but has no enabled filesets"](https://discuss.elastic.co/t/filebeat-suricata-module-module-suricata-is-configured-but-has-no-enabled-filesets/329954):
>
> I'm running filebeat 8.6.2. I initially had it grabbing /var/log/remote.log and it worked fine. Then I enabled the suricata module and set the configuration to this (excluding the output.elasticsearch section): filebeat.inputs: - type: log paths: - /var/log/remote.log processors: - add\_host\_metadata: ~ - add\_cloud\_metadata: ~ - syslog: field: message format: auto ignore\_missing: false ignore\_failure: false filebeat.mod…

---

<div class="post-metadata">

**Author:** ![rayobe4014](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@rayobe4014](https://discuss.elastic.co/u/rayobe4014)\
**Post date:** [April 8, 2024, 1:49am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/3 "2024-04-08T01:49:15Z")

</div>

Do I need to do the same server (Suricata and Elastic in 1 server ) or I need to separate server 1 for Suricata and 1 for Elastic ? Because my project is deploy Suricata send logs to Elastic and view dashboard on Evebox.  
Can you recommend for me please, If I do wrong way please guide me to do a right way  
Best regards.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 8, 2024, 2:00am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/4 "2024-04-08T02:00:40Z")

</div>

You will need to follow the [Suricata documentation](https://docs.suricata.io/en/latest/quickstart.html) recommendations as this is The Elastic community forum, and I am not an expert on Suricata.

In general, it is not the best practice to install other resource-intensive applications on the same VM / Host as Elasticsearch, so my initial advice would be to not put them on the same host.

Perhaps check with the Suricata Forum:

> **[Topics tagged community](https://forum.suricata.io/tag/community)**
>
> Topics tagged community

Or perhaps someone other than I will make a suggestion... perhaps @leandrojmp

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 8, 2024, 4:24pm UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/5 "2024-04-08T16:24:35Z")

</div>

> [@rayobe4014](#):
>
> Do I need to do the same server (Suricata and Elastic in 1 server ) or I need to separate server 1 for Suricata and 1 for Elastic ?

I do not use Suricata so I do not know how resource intensive it is.

But it is recommended for Elasticsearch to be the only service running on the server.

To get logs from Suricata, there is a native Elastic Agent [integration](https://docs.elastic.co/integrations/suricata) that you could use, so you would need also Kibana and Fleet Server.

So you could have one server running Elasticsearch + Kibana + Fleet Server and another one with Suricata + Elastic Agent with Suricata integration.

---

<div class="post-metadata">

**Author:** ![rayobe4014](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@rayobe4014](https://discuss.elastic.co/u/rayobe4014)\
**Post date:** [April 9, 2024, 12:52am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/6 "2024-04-09T00:52:59Z")

</div>

Can u please recommend me about performance and spec of server please.

---

<div class="post-metadata">

**Author:** ![rayobe4014](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@rayobe4014](https://discuss.elastic.co/u/rayobe4014)\
**Post date:** [April 9, 2024, 4:28am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/7 "2024-04-09T04:28:20Z")

</div>

I just install Elastic+kibana+ Fleet server successful  
but when I try to install agent on suricat server I got this error

```auto
Elastic Agent will be installed at /opt/Elastic/Agent and will run as a service. Do you want to continue? [Y/n]:y

[==] Service Started [32s] Elastic Agent successfully installed, starting enrollment.

[====] Waiting For Enroll... [33s] {"log.level":"info","@timestamp":"2024-04-09T00:20:30.689-0400","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":519},"message":"Starting enrollment to URL: https://192.168.15.11:8220/","ecs.version":"1.6.0"}

[=] Waiting For Enroll... [33s] {"log.level":"info","@timestamp":"2024-04-09T00:20:31.260-0400","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":528},"message":"1st enrollment attempt failed, retrying for 10m0s, every 1m0s enrolling to URL: https://192.168.15.11:8220/","ecs.version":"1.6.0"}

Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority

For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.13/fleet-troubleshooting.html

[==] Uninstalled [35s] Error uninstalling. Printing logs

{debug 2024-04-09 00:20:31.78147904 -0400 EDT m=+52.369115206 processes Error fetching PID info for 2, skipping: FillPidMetrics: error getting metadata for pid 2: error fetching exe from pid 2: readlink /proc/2/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 }

{debug 2024-04-09 00:20:31.78157317 -0400 EDT m=+52.369209328 processes Error fetching PID info for 3, skipping: FillPidMetrics: error getting metadata for pid 3: error fetching exe from pid 3: readlink /proc/3/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 }

{debug 2024-04-09 00:20:31.78163741 -0400 EDT m=+52.369273570 processes Error fetching PID info for 4, skipping: FillPidMetrics: error getting metadata for pid 4: error fetching exe from pid 4: readlink /proc/4/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 }

{debug 2024-04-09 00:20:31.781699306 -0400 EDT m=+52.369335457 processes Error fetching PID info for 5, skipping: FillPidMetrics: error getting metadata for pid 5: error fetching exe from pid 5: readlink /proc/5/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 }

{debug 2024-04-09 00:20:31.78176718 -0400 EDT m=+52.369403340 processes Error fetching PID info for 6, skipping: FillPidMetrics: error getting metadata for pid 6: error fetching exe from pid 6: readlink /proc/6/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 }

{debug 2024-04-09 00:20:31.781831391 -0400 EDT m=+52.369467541 processes Error fetching PID info for 7, skipping: FillPidMetrics: error getting metadata for pid 7: error fetching exe from pid 7: readlink /proc/7/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 }

{debug 2024-04-09 00:20:31.781913273 -0400 EDT m=+52.369549424 processes Error fetching PID info for 8, skipping: FillPidMetrics: error getting metadata for pid 8: error fetching exe from pid 8: readlink /proc/8/exe: no such file or directory github.com/elastic/elastic-agent-system-metrics@v0.9.2/metric/system/process/process.go:173 

```

But when I try to set fleet server to http:// ip add:8220  
I can't add fleet sever.  
When I try to add https it's success but I failed when I try to install agent on Suricata server please guide me how to solve this problem sir  
Best regards.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 9, 2024, 5:26am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/8 "2024-04-09T05:26:56Z")

</div>

Perhaps the trouble shooting guide... For that exact error

> **[Troubleshoot common problems | Fleet and Elastic Agent Guide \[8.13\] | Elastic](https://www.elastic.co/guide/en/fleet/current/fleet-troubleshooting.html#agent-enrollment-certs)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2024, 5:27am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/9 "2024-05-07T05:27:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.