ML
    • Register
    • Login
    • Search
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups

    Anyone tried ELK stack before ???

    IT Discussion
    elasticsearch elk logging logstash kibana
    5
    9
    459
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • IT-ADMIN
      IT-ADMIN last edited by scottalanmiller

      Hello guys

      anyone tried ELK : (elasticsearch+logstash+kibana) stack before ? i have a couple of question ?

      1 Reply Last reply Reply Quote 1
      • coliver
        coliver last edited by

        I've got Graylog running. I've run ELK in my lab previously but prefer Graylog.

        IT-ADMIN 1 Reply Last reply Reply Quote 0
        • travisdh1
          travisdh1 last edited by

          https://mangolassi.it/topic/8201/building-elk-on-centos-7/2
          https://mangolassi.it/topic/5365/setting-up-logstash-for-elk
          https://mangolassi.it/topic/3610/problems-setting-up-an-elk-stack/3

          It's been a couple of years since a lot of discussion and walkthroughs were written on it. Lots, and I forgot a lot of what I did with it.

          JaredBusch 1 Reply Last reply Reply Quote 0
          • IT-ADMIN
            IT-ADMIN @coliver last edited by

            @coliver Hi Sir

            the management recommend me to use ELK as SIEM for our logs
            the problem is : i get stuck at "Successfully started Logstash API endpoint {:port=>9600}" while trying to ingest txt log file into elasticsearch

            here is my config file :

            input {
            file {
            path => "C:\Users\mustapha\Desktop\test.txt"
            start_position => "beginning"
            }
            }
            filter {
            grok {
            match => {"message" => "%{WORD:username} %{WORD:email} %{WORD:hash}" }
            }
            }
            output {
            elasticsearch {
            hosts => ["localhost:9200"]
            index => "test"
            }
            }

            my log file is :

            username email hash
            username email hash
            username email hash
            username email hash
            username email hash

            i cant even get this simple example work, am i missing something ???

            1 Reply Last reply Reply Quote 0
            • IT-ADMIN
              IT-ADMIN last edited by

              0_1541080301199_Sans titre.png

              1 Reply Last reply Reply Quote 0
              • scottalanmiller
                scottalanmiller last edited by

                Yup, I've run ELK and it is nice. I've come to prefer Graylog2, though. Although that uses part of the ELK stack, they are highly related.

                1 Reply Last reply Reply Quote 0
                • scottalanmiller
                  scottalanmiller last edited by

                  ELK's weakness is security, that traditionally was an add-on that you had to pay for whereas it was part of the free open source product with Graylog.

                  1 Reply Last reply Reply Quote 0
                  • JaredBusch
                    JaredBusch @travisdh1 last edited by

                    @travisdh1 said in Anyone tried ELK stack before ???:

                    https://mangolassi.it/topic/8201/building-elk-on-centos-7/2
                    https://mangolassi.it/topic/5365/setting-up-logstash-for-elk
                    https://mangolassi.it/topic/3610/problems-setting-up-an-elk-stack/3

                    It's been a couple of years since a lot of discussion and walkthroughs were written on it. Lots, and I forgot a lot of what I did with it.

                    Tags......

                    https://mangolassi.it/tags/elk

                    1 Reply Last reply Reply Quote 1
                    • scottalanmiller
                      scottalanmiller last edited by

                      Tags added.

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post