Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Revision

Date

Author

v1.0 - Added streaming for DHCP logs

2020-07-08

Sokol Gjeçi <sgjeci@rash.al>

v0.9 - Curator replaced by ILM

2020-06-27

Sokol Gjeçi <sgjeci@rash.al>

v0.8c - Added cover page

2020-02-04

Sokol Gjeçi <sgjeci@rash.al>

v0.8b - Fixed old HTTP config, Wordings corrections

2020-02-03

Sokol Gjeçi <sgjeci@rash.al>

v0.8a - Logstash: Cipher replaced by Fingerprint

2020-01-29

Sokol Gjeçi <sgjeci@rash.al>

v0.8 - SSL/TLS, Keystores, X-Pack, ELK v7.x

2019-12-15

Sokol Gjeçi <sgjeci@rash.al>

Initial document - Basic configuration

2019-05-02

Sokol Gjeçi <sgjeci@rash.al>

...

  • CPUs: 4
  • Memory: 8 GB
  • Storage: 100 GB
  • Network: 1 Gbps
  • Architecture: x86_64
  • OS: CentOS 7

...

  • wifimon-node1.rash.al↔10.254.24.230→ master-eligible / data node
  • wifimon-node2.rash.al↔10.254.24.232→ master-eligible / data node
  • wifimon-node3.rash.al↔10.254.24.237→ master-eligible / data node
  • wifimon-kibana.rash.al↔10.254.24.148→ coordinating node
  • wifimon-logstash.rash.al↔10.254.24.233→ pipeline node

...

  • wifimon-node{1,2,3}.rash.al: 9200/tcp, 9300/tcp
  • wifimon-kibana.rash.al: 9200/tcp, 9300/tcp, 5601/tcp
  • wifimon-logstash.rash.al: 5044/tcp

...

Wiki Markup
transport.publish_address was printed as \[ip:port\] instead of\[hostname/ip:port\]. This format is deprecated and will change to\[hostname/ip:port\] in a future version. Use-Des.transport.cname_in_publish_address=true to enforcenon-deprecated formatting.

...

Wiki Markup
discovery.seed_hosts: \[

...

Wiki Markup
#cluster.initial_master_nodes: \[

...

Wiki Markup
discovery.seed_hosts: \[

...

Wiki Markup
#cluster.initial_master_nodes: \[

...

Wiki Markup
discovery.seed_hosts: \[

...

Wiki Markup
#cluster.initial_master_nodes: \[

...

Wiki Markup
discovery.seed_hosts: \[

...

Wiki Markup
elasticsearch.hosts: \["https://wifimon-kibana.rash.al:9200"\]

...

Wiki Markup
elasticsearch.ssl.certificateAuthorities: \["/etc/kibana/certs/ca.crt"\]

...

Wiki Markup
Jun 18 19:15:20 centos dhcpd\[11223\]: DHCPREQUEST for 192.168.1.200 from a4:c4:94:cd:35:70 (galliumos) via wlp6s0
Wiki Markup
Jun 18 19:15:20 centos dhcpd\[11223\]: DHCPACK on 192.168.1.200 to a4:c4:94:cd:35:70 (galliumos) via wlp6s0

...

Wiki Markup
multiline.pattern: '^\[\[:space:\]\]'

...

Wiki Markup
fields: \['input', 'host', 'agent', 'acs', 'log', 'ecs'\]

...

Wiki Markup
include_lines: \['DHCPACK'\]

...

Wiki Markup
fields: \['input', 'host', 'agent', 'acs', 'log', 'ecs'\]

...

Wiki Markup
\{"@timestamp":"2020-06-28T09:20:17.834Z","@metadata":\{"beat":"filebeat","type":"_doc","version":"7.8.0"\},"message":"Jun 18 19:15:20 centos dhcpd\[11223\]: DHCPACK on 192.168.1.200 to a4:c4:94:cd:35:70 (galliumos) via wlp6s0","logtype":"dhcp"\}

...

Wiki Markup
hosts: \["wifimon-logstash.rash.al:5044"\]
Wiki Markup
ssl.certificate_authorities: \["/etc/filebeat/certs/ca.crt"\]

...

Wiki Markup
# filebeat setup --index-management \{color}
{color:#333333}-E output.logstash.enabled=false \{color}
{color:#333333}-E 'output.elasticsearch.hosts=\["wifimon-kibana.rash.al:9200"\]' \{color}
{color:#333333}-E output.elasticsearch.protocol=https \{color}
{color:#333333}-E output.elasticsearch.username=elastic \{color}
{color:#333333}-E output.elasticsearch.password=elastic-password-goes-here \{color}
{color:#333333}-E 'output.elasticsearch.ssl.certificate_authorities=\["/etc/filebeat/certs/ca.crt"\]'

...

Wiki Markup
monitoring.elasticsearch.ssl.certificate_authorities: \["/etc/filebeat/certs/ca.crt"\]

...

Wiki Markup
monitoring.elasticsearch.hosts: \["https://wifimon-kibana.rash.al:9200"\]

...

Wiki Markup
ssl_certificate_authorities => \["/etc/logstash/certs/ca.crt"\]

...

Wiki Markup
if (\[logtype\] == "radius") \{

...

Wiki Markup
mutate \{ gsub => \[ "message", "\[\n\t\]+", " " \] \}

...

Wiki Markup
include_keys => \[

...

Wiki Markup
remove_field => \[

...

Wiki Markup
if "beats_input_codec_plain_applied" in \[tags\] \{
Wiki Markup
mutate \{ remove_tag => \["beats_input_codec_plain_applied"\] \}

...

Wiki Markup
remove_field => \[

...

Wiki Markup
if "beats_input_codec_plain_applied" in \[tags\] \{
Wiki Markup
mutate \{ remove_tag => \["beats_input_codec_plain_applied"\] \}

...

Wiki Markup
"tags" => \[\]

...

Wiki Markup
"tags" => \[\],

...

Wiki Markup
"cluster": \[

...

Wiki Markup
"indices": \[

...

Wiki Markup
"names": \[

...

Wiki Markup
"privileges": \[

...

Wiki Markup
"grant": \[

...

Wiki Markup
"run_as": \[\],

...

Wiki Markup
"roles": \["logstash_writer_role"\],

...

Wiki Markup
hosts => \["https://wifimon-kibana.rash.al"\]

...

Wiki Markup
hosts => \["https://wifimon-kibana.rash.al"\]

...

Wiki Markup
"index_patterns": \["radiuslogs", "dhcplogs"\],

...

Wiki Markup
hosts => \["https://wifimon-kibana.rash.al"\]

...

Wiki Markup
hosts => \["https://wifimon-kibana.rash.al"\]

...