Hello Everyone, i'll start by saying...newbe here and i'm lost. I'm trying to setup BRO and ELK stack. I'm following https://github.com/BrashEndeavours/bro-elk-IDS. I have my BRO ids and ELK stack on the same server for testing. I'm running Ubuntu Desktop 16.04.2 I'm running into an issue where when I login to Kibana its saying it is unable to fetch mappings. I've confirmed that BRO is generating logs and running. I'm thinking its an issue with my logstash_bro.conf but honestly.... i'm not sure. Here is my current configuration:
Logstash_bro.conf
16:42:53 ✔ root:/nsm/logstash/config/pipeline$ cat logstash_bro.conf
input {
stdin {
}
# Production Logs#############################
bro {
type => "app_stats"
path => "/nsm/bro/logs/current/app_stats.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "conn"
path => "/nsm/bro/logs/current/conn.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "dns_entropy"
path => "/nsm/bro/logs/current/dns_entropy.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "dhcp"
path => "/nsm/bro/logs/current/dhcp.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "dns"
path => "/nsm/bro/logs/current/dns.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "dpd"
path => "/nsm/bro/logs/current/dpd.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "files"
path => "/nsm/bro/logs/current/files.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "http"
path => "/nsm/bro/logs/current/http.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "http_entropy"
path => "/nsm/bro/logs/current/http_entropy.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "kerberos"
path => "/nsm/bro/logs/current/kerberos.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "known_certs"
path => "/nsm/bro/logs/current/known_certs.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "known_hosts"
path => "/nsm/bro/logs/current/known_hosts.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "known_services"
path => "/nsm/bro/logs/current/known_services.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "intel"
path => "/nsm/bro/logs/current/intel.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "notice"
path => "/nsm/bro/logs/current/notice.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "pe"
path => "/nsm/bro/logs/current/pe.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "rdp"
path => "/nsm/bro/logs/current/rdp.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "sip"
path => "/nsm/bro/logs/current/sip.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "smtp"
path => "/nsm/bro/logs/current/smtp.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "socks"
path => "/nsm/bro/logs/current/socks.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "software"
path => "/nsm/bro/logs/current/software.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "ssh"
path => "/nsm/bro/logs/current/ssh.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "ssl"
path => "/nsm/bro/logs/current/ssl.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "syslog"
path => "/nsm/bro/logs/current/syslog.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "traceroute"
path => "/nsm/bro/logs/current/traceroute.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "weird"
path => "/nsm/bro/logs/current/weird.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
bro {
type => "x509"
path => "/nsm/bro/logs/current/x509.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
# Benchmark!
filter {
metrics {
meter => "benchmark"
add_tag => "metric"
}
}
output {
if "metric" in [tags] {
stdout {
codec => line {
format => "%{[benchmark][rate_1m]} requests/sec, ( %{[benchmark][count]} total)"
}
}
}
# stdout { codec => rubydebug }
elasticsearch {
hosts => ["127.0.0.1:9200"]
}
}
Any help would be greatly appreciated!