Derek_Liu
August 7, 2018, 10:45pm
1
I am trying to use packetbeat to monitor users' search queries and store them into elasticsearch using logstash. However, when I am trying to test it out on my local, packetbeat does not capture any of search queries I executed on elasticsearch on localhost.
I have changed the configuration file to listen for HTTP traffic:
- type: http
# Configure the ports where to listen for HTTP traffic. You can disable
# the HTTP protocol by commenting out the list of ports.
# ports: [80, 8080, 8000, 5000, 8002]
ports: [9200]
send_request: true
include_body_for: ["application/json", "x-www-form-urlencoded"]
It also seems like that packetbeat does not generate any log files at all while running, as in the log folders is always empty.
pierhugues
August 8, 2018, 2:50pm
2
@Derek_Liu From a quick look at the configuration It look OK, so Lets start packetbeat in console mode and with debugging one, make sure you only have the http module enabled since this could be noisy.
The following command will output all the error and warnings to the active console.
packetbeat -v -e -c youconfig.yml -d "*"
Derek_Liu
August 8, 2018, 4:30pm
4
2018-08-08T09:29:56.033-0700 INFO instance/beat.go:492 Home path: [C:\Program Files\Packetbeat] Config path: [C:\Program Files\Packetbeat] Data path: [C:\Program Files\Packetbeat\data] Logs path: [C:\Program Files\Packetbeat\logs]
2018-08-08T09:29:56.053-0700 DEBUG [protos] protos/protos.go:105 registered protocol plugin: http
2018-08-08T09:29:56.053-0700 DEBUG [processors] processors/processor.go:49 Processors:
Still no logs generated.
pierhugues
August 8, 2018, 5:57pm
5
@Derek_Liu I presume you are running everything on the same machine, packetbeat and elasticsearch?
You might want to change the interface you are listening too to make sure we capture the packet.
I had to use 'lo0' on macos x to correctly capture local traffic.
system
September 5, 2018, 7:57pm
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.