# Iptables Filebeat

**URL:** <https://discuss.elastic.co/t/iptables-filebeat/183856>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [June 2, 2019, 9:24am UTC](https://discuss.elastic.co/t/iptables-filebeat/183856 "2019-06-02T09:24:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheSun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thesun/32/44614_2.png) [@TheSun](https://discuss.elastic.co/u/TheSun)\
**Post date:** [June 2, 2019, 9:24am UTC](https://discuss.elastic.co/t/iptables-filebeat/183856/1 "2019-06-02T09:24:33Z")

</div>

Hi,  
I run the ELK service on ubuntu. I use Filebeat, Elasticsearch and Kibana.  
I have a problem about dashboard. Filebeat Iptables dashboard displays a bit of data when I PING, but Ubiquiti Firewall logs does not show anything. How does it show warnings?  
Help me please!!! Thanks!!  
iptables.yml

```
# Set which input to use between syslog (default) or file.
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/kern.log"]
```

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [June 3, 2019, 8:50am UTC](https://discuss.elastic.co/t/iptables-filebeat/183856/2 "2019-06-03T08:50:21Z")

</div>

The Ubiquity dashboard is for iptables logs collected from Ubiquiti Networks firewall devices. These devices usually send logs to Filebeat over the network via `syslog`.

If you have one of those devices, you need to use:

```auto
var.input: syslog
var.syslog_host: 0.0.0.0
var.syslog_port: 9001 # change this if needed

```

And then point your device to send Syslog to the right address so that it can reach Filebeat.

---

<div class="post-metadata">

**Author:** ![TheSun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thesun/32/44614_2.png) [@TheSun](https://discuss.elastic.co/u/TheSun)\
**Post date:** [June 4, 2019, 12:08pm UTC](https://discuss.elastic.co/t/iptables-filebeat/183856/3 "2019-06-04T12:08:49Z")

</div>

Thanks @adrisr!!  
Oh, only devices Ubiquiti Networks can display data in Ubiquiti Firewall logs.  
I only use iptables as a firewall. Is there any way to display the blocked address on the kibana dashboard?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2019, 2:08pm UTC](https://discuss.elastic.co/t/iptables-filebeat/183856/4 "2019-07-02T14:08:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.