Running ELK Stack - Lab Environment - Ubuntu

Elastic Stack Beats
1

a newbie trying to integrate zeek logs and import them to elk stack.

Running a lab environment inside Ubuntu 20.04.
Elk stack running using Google Cloud Platform

Tried to config filebeats, but I might be getting the configurations wrong.

I tried googling and youtubing the installation process, but unsuccessful.

2

Welcome to our community! :smiley:

It's not clear what problems you are having here. You will need to share a bit more detail.

3

So basically I've built a lab environment on a vm. My goal is to send zeek logs to elk stack. Now I am very new to ubuntu, let alone install and config zeek and elk stack to work. I think my yml files are not being configured correctly but the problem can be a number of other things.

I was able to install zeek, elk stack and filebeat (following youtube videos) but the problem lies in connecting the two to work in conjunction. Where do I begin to look for solutions?

4

sudo: /etc/filebeat/modules.d/zeek.yml: command not found
ubuntu@ubuntu-virtual-machine:~$ sudo vim /etc/filebeat/modules.d/zeek.yml
ubuntu@ubuntu-virtual-machine:~$
ubuntu@ubuntu-virtual-machine:~$ sudo filebeat setup
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://localhost:9200: Get "http://localhost:9200": dial tcp 127.0.0.1:9200: connect: connection refused]
ubuntu@ubuntu-virtual-machine:~$

5

What video was it?
What do your Elasticsearch logs show?

6

i was able to figure out the problem --the input output paths had to be configured.

7

image
image2171×1206 230 KB

Is this how a normal home screen should look like? alot of the videos show "elastic kibana" and look different to mine. Any suggestions?

1 Like
8

Yup ... Looks Good

Technically that is the Analytics Overview Page. The Home is the little "Home" button at the top.

The Elastic Stack and Kibana in particular have going through a lot of innovation / refinement recently so docs / video etc fall out of date quickly. The basic concepts remain the same though.

9

Stephen - thanks for the response, appreciate it, i was pulling my hair trying to it figure out.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.