Dear All,
I am new to ELK stack. I am unable to add/load geoip details into my elasticsearch/logstash. I have installed ELK 6.7 version + filebeat & metricbeat,
I tried using /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-geoip
but it gave error and on further digging got to know that in 6.7 such modules are inbuilt and not required to execute such command.
Below are the details of my config. I want to add geospatial info of all geo related info including source and destination ip based location. How should I achieve this? Any help will be appretiated
======== Elasticsearch.yml: on 192.168.1.1 =========
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
cluster.name: ELK-test
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
node.name: Master-1
node.master: true
node.data: false
#---------------- Network -----------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 192.168.1.1
http.port: 9200
#discovery.zen.ping.unicast.hosts: ["192.168.1.1", "192.168.1.2", "192.168.1.3"]
=========== logstash.yml on 192.168.1.2: ===============
# ------------ Node identity ------------
#
# Use a descriptive name for the node:
#
# node.name: test
node.name: cnode-1
# ------------ Data path ------------------
path.data: /var/lib/logstash
path.data: /var/lib/logstash
02-beats-input.conf
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
10-syslog-filter.conf
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGLINE}" }
}
date {
match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
geoip {
source => "clientip"
}
}
}
30-elasticsearch-output.conf
output {
elasticsearch {
hosts => ["192.168.1.2:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
======== filebeat.yml on 192.168.1.2 ===========
#======== Filebeat inputs ===============
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/secure
- /var/log/messages
#- c:\programdata\elasticsearch\logs\*
#============== Kibana =============
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
# Kibana Host
# Scheme and port can be left out and will be set to the default (http and 5601)
# In case you specify and additional path, the scheme is required: http://localhost:5601/path
# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
#host: "localhost:5601"
host: "192.168.1.3:5601"
#--------- Elasticsearch output -------------
#output.elasticsearch:
# Array of hosts to connect to.
#hosts: ["192.168.1.1:9200"]
# Enabled ilm (beta) to use index lifecycle management instead daily indices.
#ilm.enabled: false
# Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#------------ Logstash output -------------
output.logstash:
# The Logstash hosts
hosts: ["192.168.1.2:5044"]
pipeline: geoip-info
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
----------------- filebeat modules---------------------
- module: system
# Syslog
syslog:
enabled: true
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
#var.paths:
# Convert the timestamp to UTC. Requires Elasticsearch >= 6.1.
#var.convert_timezone: false
# Authorization logs
auth:
enabled: true
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
#var.paths:
# Convert the timestamp to UTC. Requires Elasticsearch >= 6.1.
#var.convert_timezone: false
