# QUESTION ABOUT ELK SIEM **URL:** \ **Category:** Kibana\ **Created:** [April 5, 2022, 12:24pm UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633 "2022-04-05T12:24:58Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![Firas\_Bougrine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/firas_bougrine/32/103349_2.png) [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Post date:** [April 6, 2022, 8:29pm UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/24 "2022-04-06T20:29:24Z")
```auto # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluste> # # Please consult the documentation for further information on configuration opt> # https://www.elastic.co/guide/en/elasticsearch/reference/index.html # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # #cluster.name: my-application # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # node.name: node-1 # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by com> # path.data: /var/lib/elasticsearch # # Path to log files: # path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # By default Elasticsearch is only accessible on localhost. Set a different # address here to expose this node on the network: # network.host: 0.0.0.0 # # By default Elasticsearch listens for HTTP traffic on the first free port it # finds starting at 9200. Set a specific HTTP port here: # # By default Elasticsearch listens for HTTP traffic on the first free port it # finds starting at 9200. Set a specific HTTP port here: # http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when this node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # #discovery.seed_hosts: ["host1", "host2"] # # Bootstrap the cluster using an initial set of master-eligible nodes: # cluster.initial_master_nodes: ["node-1", "node-2"] # For more information, consult the discovery and cluster formation module docu> # # ---------------------------------- Various --------------------------------- #----------------------- BEGIN SECURITY AUTO CONFIGURATION --------------------> # # The following settings, TLS certificates, and keys have been automatically > # generated to configure Elasticsearch security features on 05-04-2022 22:37:23 # # -----------------------------------------------------------------------------> # Enable security features xpack.security.enabled: true xpack.security.enrollment.enabled: true # Enable encryption for HTTP API client connections, such as Kibana, Logstash, > xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12 # Enable encryption and mutual authentication between cluster nodes xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 # Create a new cluster with the current node only # Additional nodes can still join the cluster later cluster.initial_master_nodes: ["elastic"] # Allow HTTP API connections from localhost and local networks # Connections are encrypted and require user authentication http.host: [_local_, _site_] # Allow other nodes to join the cluster from localhost and local networks # Connections are encrypted and mutually authenticated #transport.host: [_local_, _site_] #----------------------- END SECURITY AUTO CONFIGURATION ----------------------> ``` type or paste code here ````Preformatted text` ```auto ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [April 7, 2022, 1:03am UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/25 "2022-04-07T01:03:32Z")
You have 2 different settings `cluster.initial_master_nodes: ["node-1", "node-2"]` `cluster.initial_master_nodes: ["elastic"]` comment out the second one.... I would also review this section of the doc > **[Bootstrapping a cluster | Elasticsearch Guide \[8.1\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery-bootstrap-cluster.html)** How many nodes cluster are you trying to start? ---
**Author:** ![Firas\_Bougrine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/firas_bougrine/32/103349_2.png) [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Post date:** [April 7, 2022, 1:41pm UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/26 "2022-04-07T13:41:51Z")
done thanks it's work finaly ---
**Author:** ![Firas\_Bougrine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/firas_bougrine/32/103349_2.png) [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Post date:** [April 7, 2022, 1:45pm UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/27 "2022-04-07T13:45:25Z")
i have other question what's mean when i put in network.host: 0.0.0.0 , what's this (0.0.0.0) ? ---
**Author:** ![FALEN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/falen/32/82754_2.png) [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Post date:** [April 11, 2022, 2:03pm UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/28 "2022-04-11T14:03:21Z")
Its actually binds all the IPs available in the server, this helps if you are using reverse proxy, external ip or multiple network interfaces. If you have single IP, you can change it to that. But i prefer to left it 0.0.0.0. Because if you change it to spesific IP, that can block localhost:9200 access which probably configured within your kibana ---
**Author:** ![Firas\_Bougrine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/firas_bougrine/32/103349_2.png) [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Post date:** [April 13, 2022, 10:24am UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/29 "2022-04-13T10:24:44Z")
```auto firas@elastic:~$ sudo systemctl restart elasticsearch.service Job for elasticsearch.service failed because a timeout was exceeded. See "systemctl status elasticsearch.service" and "journalctl -xe" for details. firas@elastic:~$ sudo systemctl restart elasticsearch.service firas@elastic:~$ sudo nano /etc/elasticsearch/elasticsearch.yml ``` why when I tried to (restart) Elasticsearch it does not start and when I repeat the restart again it works You sent With kibana also what is the cause of this delay? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 11, 2022, 10:24am UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633/30 "2022-05-11T10:24:54Z")
Closed on May 11, 2022, 10:24am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/question-about-elk-siem/301633.md?page=1)