# Is there an instruction for installing and configuring osquery in Elasticsearch/Kibana?

**URL:** <https://discuss.elastic.co/t/is-there-an-instruction-for-installing-and-configuring-osquery-in-elasticsearch-kibana/174055>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 27, 2019, 7:04am UTC](https://discuss.elastic.co/t/is-there-an-instruction-for-installing-and-configuring-osquery-in-elasticsearch-kibana/174055 "2019-03-27T07:04:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![patsevanton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patsevanton/32/42692_2.png) [@patsevanton](https://discuss.elastic.co/u/patsevanton)\
**Post date:** [March 27, 2019, 7:04am UTC](https://discuss.elastic.co/t/is-there-an-instruction-for-installing-and-configuring-osquery-in-elasticsearch-kibana/174055/1 "2019-03-27T07:04:47Z")

</div>

I installed Filebeat, Elasticsearch, Kibana 6.6.2

```
filebeat modules enable osquery
sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm
sudo yum install osquery

```

Status osquery

```
systemctl status osquery

```

Ok

```
systemctl restart filebeat

```

 ![Screenshot%20from%202019-03-27%2013-06-22](https://us1.discourse-cdn.com/elastic/original/3X/f/e/febfbcb994e9f169ab2d26d790013888d5871ffc.png)

Config Osquery

```
cat /etc/osquery/osquery.conf | grep -v "//" | grep -v "^$"
{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "utc": "true"
  },
  "schedule": {
    "system_info": {
      "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
      "interval": 3600
    }
  },
  "decorators": {
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;",
      "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
    ]
  },
  "packs": {
  },
  "feature_vectors": {
    "character_frequencies": [
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.00045, 0.01798,
      0.0, 0.03111, 0.00063, 0.00027, 0.0, 0.01336, 0.0133,
      0.00128, 0.0027, 0.00655, 0.01932, 0.01917, 0.00432, 0.0045,
      0.00316, 0.00245, 0.00133, 0.001029, 0.00114, 0.000869, 0.00067,
      0.000759, 0.00061, 0.00483, 0.0023, 0.00185, 0.01342, 0.00196,
      0.00035, 0.00092, 0.027875, 0.007465, 0.016265, 0.013995, 0.0490895,
      0.00848, 0.00771, 0.00737, 0.025615, 0.001725, 0.002265, 0.017875,
      0.016005, 0.02533, 0.025295, 0.014375, 0.00109, 0.02732, 0.02658,
      0.037355, 0.011575, 0.00451, 0.005865, 0.003255, 0.005965, 0.00077,
      0.00621, 0.00222, 0.0062, 0.0, 0.00538, 0.00122, 0.027875,
      0.007465, 0.016265, 0.013995, 0.0490895, 0.00848, 0.00771, 0.00737,
      0.025615, 0.001725, 0.002265, 0.017875, 0.016005, 0.02533, 0.025295,
      0.014375, 0.00109, 0.02732, 0.02658, 0.037355, 0.011575, 0.00451,
      0.005865, 0.003255, 0.005965, 0.00077, 0.00771, 0.002379, 0.00766,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
      0.0, 0.0, 0.0
    ]
  }    
}
```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [March 28, 2019, 8:20am UTC](https://discuss.elastic.co/t/is-there-an-instruction-for-installing-and-configuring-osquery-in-elasticsearch-kibana/174055/2 "2019-03-28T08:20:11Z")

</div>

There is a guide on the module: [https://www.elastic.co/guide/en/beats/filebeat/6.7/filebeat-module-osquery.html](https://www.elastic.co/guide/en/beats/filebeat/6.7/filebeat-module-osquery.html)

---

<div class="post-metadata">

**Author:** ![patsevanton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patsevanton/32/42692_2.png) [@patsevanton](https://discuss.elastic.co/u/patsevanton)\
**Post date:** [March 28, 2019, 9:49am UTC](https://discuss.elastic.co/t/is-there-an-instruction-for-installing-and-configuring-osquery-in-elasticsearch-kibana/174055/3 "2019-03-28T09:49:15Z")

</div>

This guide dont have config for osquery.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2019, 9:49am UTC](https://discuss.elastic.co/t/is-there-an-instruction-for-installing-and-configuring-osquery-in-elasticsearch-kibana/174055/4 "2019-04-25T09:49:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.