Cannot get data to display Suricata dashbord and Firewall dashbord #538
Replies: 1 comment
-
@TieuBinh123 an issues, issue #539 was opened for this inquiry. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I have installed Suricata on pfSense and ELK. I tried sending data from the pfSense machine and checked the logs on the pfSense machine, and there were no issues. However, the log in Logstash shows an error indicating that it could not send data to Elasticsearch.
Im install in vmware
PFSENSE
24.2 beta2 - pfsense 2.7.2
Screenshot
I have tried with both RFC5424 and RFC3164, but neither worked.
![image](https://private-user-images.githubusercontent.com/107189807/334655733-437cee88-b225-4648-8df7-453fae38d3de.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxNTE3MjcsIm5iZiI6MTcyNjE1MTQyNywicGF0aCI6Ii8xMDcxODk4MDcvMzM0NjU1NzMzLTQzN2NlZTg4LWIyMjUtNDY0OC04ZGY3LTQ1M2ZhZTM4ZDNkZS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTEyJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkxMlQxNDMwMjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT04ZTcwNmU4N2JjNDU5YWMzY2NkODkzNmFkNDUxZWFhYzFmODJkZmUzODgxYzNmZGMwMjU2MzM1ODQ4ODc4Mzk4JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.VJIvoTNPadBzV_9Fuap3B5PO_tgSOXvVEbY2DMCLXIw)
![image](https://private-user-images.githubusercontent.com/107189807/334655770-35c31f62-58f5-45a8-b02f-7fa2e7ee610e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxNTE3MjcsIm5iZiI6MTcyNjE1MTQyNywicGF0aCI6Ii8xMDcxODk4MDcvMzM0NjU1NzcwLTM1YzMxZjYyLTU4ZjUtNDVhOC1iMDJmLTdmYTJlN2VlNjEwZS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTEyJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkxMlQxNDMwMjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00MzNiYTQ2MDI1ODZmMWIzNGZiNTdiZjk1YmIxNjFlOWIwY2RmZTMzN2M2YWU5MzhkYTM3YTA5NzYzZDcxNzRlJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.yWAyYmh1lPOCyNtF5rGOQariEzhxvKhkVVYMsNNHtWI)
Log suricata
![image](https://private-user-images.githubusercontent.com/107189807/334653503-3ccd3d90-f917-4f34-a730-a7ffd9a78bc9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxNTE3MjcsIm5iZiI6MTcyNjE1MTQyNywicGF0aCI6Ii8xMDcxODk4MDcvMzM0NjUzNTAzLTNjY2QzZDkwLWY5MTctNGYzNC1hNzMwLWE3ZmZkOWE3OGJjOS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTEyJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkxMlQxNDMwMjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT05MGE1MjRkZmFlZjhlMzM5MTkyNTlkNmQ2MDUwNDA1MDVmYmQwZjUyYzNhOGQ4M2IwNWU5ODNjMWE3MDk2MmJhJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.soZ-SJNW2Iu2OKyozo0vyzPxtxo1wNHR9gcDMk4opcA)
I have fully installed the pfELK packages on ELK.
Log Logstash
[2024-05-29T12:02:25,047][WARN ][logstash.outputs.elasticsearch][pfelk][6bb69d12df47f484da6edfc05eb82144a3ecc1409df56a5f949148c81f635d6b] Could not index event to Elasticsearch. {:status=>404, :action=>["create", {:_id=>nil, :_index=>"logs-pfelk-suricata", :routing=>nil}, {"@timestamp"=>2024-05-29T05:02:24.816720298Z, ...}], :response=>{"create"=>{"status"=>404, "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such index [logs-pfelk-suricata] and composable template [-pfelk-suricata] forbids index auto creation", "index_uuid"=>"na", "index"=>"logs-pfelk-suricata"}}}
Beta Was this translation helpful? Give feedback.
All reactions