SSH login attempts dashboard on kibana

Tek_Chand · October 11, 2018, 11:33am

@Prasobh, Before proceeding i have one querie for you because filebeat configuration depend upon it.

What you want to use for output in filebeat? Means you want to use logstash or want send logs directly to Elasticsearch?

Please provide the filebeat config in formatted way. You can use the below symbol to format it i.e three ``` at start of content and end of content.

Thanks.

prasuprasobh · October 11, 2018, 12:09pm

Hello Chand...
I want to send logs directly to elasticsearch

Current configuration:

filebeat.inputs:

type: log
enabled: false
paths:
- /var/log/.log
  filebeat.config.modules:
  path: ${path.config}/modules.d/.yml
  reload.enabled: false
  setup.template.settings:
  index.number_of_shards: 3
  setup.kibana:
  output.elasticsearch:
  hosts: ["192.168.10.4:9200"]
protocol: "https"

username: "elasticsearch"
password: "elasticsearch"

Tek_Chand · October 11, 2018, 12:31pm

@Prasobh. Your filebeat.yml configuration will be look like below:

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
#    - /var/log/auth.log
#    - /var/log/syslog
#- type: log
#  paths:
#     - /var/log/syslog
#  fields_under_root: true
#  fields:
#    type: syslog_logs

    #- c:\programdata\elasticsearch\logs\*

  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ['^DBG']

  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']

  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #exclude_files: ['.gz$']

  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  #  level: debug
  #  review: 1

  ### Multiline options

  # Multiline can be used for log messages spanning multiple lines. This is common
  # for Java Stack Traces or C-Line Continuation

  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  #multiline.pattern: ^\[

  # Defines if the pattern set under pattern should be negated or not. Default is false.
  #multiline.negate: false

  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
  #multiline.match: after


#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: true

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 3
  #index.codec: best_compression
  #_source.enabled: false

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
#  env: staging


#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here, or by using the `-setup` CLI flag or the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
 # host: "192.168.99.3:5601"

#============================= Elastic Cloud ==================================

# These settings simplify using filebeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["your_es_ip:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: ["192.168.99.3:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

According to above configuration you need to enable the Filebeat module which one you want to use like system module etc. You can refer the below link:

https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-modules.html

You can also specify the path of logs which you want to send over elasticsearch. Then you need to make changes in above config file.

prasuprasobh · October 11, 2018, 12:53pm

@Chand. Thanks for your prompt reppose.

Do I need to specify the credentials to use the elasticsearc

Tek_Chand · October 12, 2018, 3:06am

@Prasobh, No need to define username and password.

Thanks.

prasuprasobh · October 15, 2018, 11:09am

hello Chand,

I have configured the filebeat with logstash and logs are moving from the client to master server.

How do I configure the dashboard for ssh login attempts.. I am not able to find the correct syntax .. Please help me

Tek_Chand · October 16, 2018, 4:05am

@Prasobh, You need to import the Filebeat dashboard which are the part of filebeat installation and configuration. You can refer the below link:

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html

You can't use Filebeat modules directly with logstash. If you want to use Filebeat dashboards like SSH Login, Syslog etc. You need to use Logstash pipeline configurations that are equivalent to the ingest node pipelines available with the Filebeat modules. Then you’ll be able to use the same dashboards available with Filebeat to visualize your data in Kibana.

You can refer the below link:

https://www.elastic.co/guide/en/logstash/5.6/filebeat-modules.html

Hope so above links will help you. Please let me know if you have any query.

Thanks.

prasuprasobh · October 17, 2018, 8:28am

Thanks Chand... I have configured the filebeat with logstash ,but when I click the anything in the dash board I am getting these kind of errors.. Any idea

Could not locate that index-pattern-field (id: system.syslog.hostname)

Could not locate that index-pattern-field (id: auditd.log.record_type)

Could not locate that index-pattern-field (id: auditd.log.acct)

Could not locate that index-pattern-field (id: auditd.log.a0)

system · November 14, 2018, 8:43am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.