Ansible scripts to set up the elk stack with zeek logging.
This will install the elk stack and filebeat. Filebeat will be installed and ship logs to port 5044.
This will also set up configuration files for logstash and filebeat necessary for zeek logging. It is assumed the zeek logs are in the folder:
/usr/local/zeek/logs/current/
If zeek is on a remote server, filebeat installation should be done on the remote server.
Various options can be set in the elk/vars/main.yml file.
Set the timezone
sudo dpkg-reconfigure tzdataSet a static IP
sudo nano /etc/netplan/01-netcfg.yaml Example network config
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: no
addresses: [192.168.8.180/24]
gateway4: 192.168.8.1
nameservers:
addresses: [8.8.8.8,8.8.4.4]Apply the network config
sudo netplan applygit clone https://github.com/iamckn/elk_ansible
cd elk_ansibleEdit the hosts file in that folder and fill in the IP field with the ELK server IP
ansible-playbook setup.yml -u root -k -i hosts -t install_elasticsearchansible-playbook setup.yml -u root -k -i hosts -t install_logstashansible-playbook setup.yml -u root -k -i hosts -t install_kibanaansible-playbook setup.yml -u root -k -i hosts -t install_filebeatansible-playbook setup.yml -u root -k -i hosts
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent