<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Mar 26, 2014 at 8:48 PM, Matt <span dir="ltr"><<a href="mailto:matt@somedamn.com" target="_blank">matt@somedamn.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div>Here's what I did for Ubuntu 12.04:<br>
<br>
<i>apt-get install libjansson-dev libgeoip-dev</i><br>
<br>
If you're starting from a clean server, there are probably other
missing dependencies. Those are just two I noticed during my
install. Libjansson is needed for the EVE output.<br>
<br>
<i>wget </i><i><a href="http://www.openinfosecfoundation.org/download/suricata-2.0.tar.gz" target="_blank">http://www.openinfosecfoundation.org/download/suricata-2.0.tar.gz</a></i><i><br>
</i><i>tar -vxzf suricata-2.0.tar.gz</i><i><br>
</i><i>cd suricata-2.0</i><i><br>
</i><i>./configure --prefix=/opt/suricata --localstatedir=/var
--enable-geoip</i><i><br>
</i><i>make</i><i><br>
</i><i>make install</i><i><br>
</i><i><i>LD_LIBRARY_PATH=/opt/suricata/lib
/opt/suricata/bin/suricata -c
/opt/suricata/etc/suricata/suricata.yaml --af-packet=eth1 -v<br>
<br>
</i></i>Suricata should be running at this point.<br>
<br>
<i><i><i>apt-get install openjdk-7-jdk openjdk-7-jre-headless
apache2</i><i><br>
</i><br>
</i></i>Again you may find other missing dependencies for ELK on
your own machines.<br>
<i><i><br>
</i></i><i>wget
<a href="https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.1.0.deb" target="_blank">https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.1.0.deb</a></i><i><br>
</i><i>wget
<a href="https://download.elasticsearch.org/logstash/logstash/packages/debian/logstash_1.4.0-1-c82dc09_all.deb" target="_blank">https://download.elasticsearch.org/logstash/logstash/packages/debian/logstash_1.4.0-1-c82dc09_all.deb</a></i><i><br>
</i><i>wget
<a href="https://download.elasticsearch.org/kibana/kibana/kibana-3.0.0.tar.gz" target="_blank">https://download.elasticsearch.org/kibana/kibana/kibana-3.0.0.tar.gz</a></i><i><br>
</i><i><br>
</i><i>dpkg -i elasticsearch-1.1.0.deb</i><i><br>
</i><i>dpkg -i logstash_1.4.0-1-c82dc09_all.deb</i><i><br>
</i><i>tar -C /var/www/ -vxzf kibana-3.0.0.tar.gz</i><i><br>
</i><i><br>
</i><i>/etc/init.d/elasticsearch start</i><br>
<br>
In case you're wondering, the elasticsearch data is stored in
/var/lib/elasticsearch by default. This is my first time using
it, so that was one of the questions I had.<br>
<br>
For logstash, I followed the instructions at
<a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output</a>.
I copied the geoip config verbatim. Note: for step 2, the
logstash conf should go in /etc/logstash/conf.d rather than
/etc/init<br>
<br>
<i>/etc/init.d/logstash start</i><br>
<br>
Note: if you're using the init script like that instead of adding
a service in /etc/init, you'll need to add "JAVA=/usr/bin/java" at
line 83 due to a bug in the script.<br>
<br>
Then just browse to <a href="http://your.server/kibana-3.0.0" target="_blank">http://your.server/kibana-3.0.0</a> and start
poking around.<span class=""><font color="#888888"><br>
<br>
<pre cols="72">Matt</pre></font></span><div class="">
On 3/26/2014 11:38 AM, Victor Julien wrote:<br>
</div></div><div class="">
<blockquote type="cite">
<pre>On 03/25/2014 11:06 PM, Cooper F. Nelson wrote:
</pre>
<blockquote type="cite">
<pre>Ok, got it working. Ultimately I ended up starting over and
installing elasticsearch via a package first. Then the published
process worked.
I appreciate everyone's help! Now I just need to figure out how
to configure the dashboard.
</pre>
</blockquote>
<pre>Feel free to try mine:
<a href="http://www.inliniac.net/files/Suricata-Eve-Dashboard" target="_blank">http://www.inliniac.net/files/Suricata-Eve-Dashboard</a>
You can load it through Kibana's 'load' button, then advanced, choose
file. I think we will include one in the suricata tarball as well.
Input welcome :)
Cheers,
Victor
</pre>
</blockquote><br></div></div></blockquote><div><br></div><div>I just updated my old guide here:<br><a href="http://pevma.blogspot.se/2014/03/suricata-and-grand-slam-of-open-source_26.html">http://pevma.blogspot.se/2014/03/suricata-and-grand-slam-of-open-source_26.html</a><br>
<br></div><div>I will update the redmine docs soon too.<br>thanks<br></div><div><br> </div></div></div></div>