In this video, I'll set up a Volbeat service to read system dialogues, so that's the diagram that's
megafauna serve other smaller search server that we set up in last video.
And it works.
So now to install a dedicated service whose job is to read log files and send it off to the elasticsearch
server and you can install FALBE on any server you want.
So there are the instructions to download from this page.
I'm going to use the Debian manager.
These are my commands here.
Log on to my server.
I'm going to use my speaker server this then presenta.
All right, C.D., Etsi Whitebait.
These are the files that came with Will edit the Volbeat, why?
OK, so let's check if it's running.
Right, it's not that's good now with Volbeat, it can read log files from many, many things that store
log files many common processes such as Web servers or radios or anything else.
So to get a list of modules of falbe can use, you can type Volbeat modules list.
OK, so here it's showing me a whole bunch of processes that you might recognize.
Tomcat Systems, Semantic Readers', Rabbit, MQ Postgres, Smyers, Cucamonga, DB Fana, lots and
lots and lots of things.
Now all those modules are disabled either on the disabled.
What I'm going to do is enable the system module, the.
By falbe modules and able system, Folbigg modules enable system now by check that list again and just
scroll up you'll see enabled system.
Excellent.
So.
It still hasn't started yet.
That's good, that's edit the Y amount.
OK, so Volbeat Input's blog OD's.
I'm not using Kobana, so I can safely comment that out.
OK, so here's where we set the address of the elasticsearch server, you could be running this locally,
but I'm not running this on a different server, on a different part of the world and my elasticsearch
server.
So we put the IP address in.
Which was that, and it was Port nine 200.
Now this server won't be able to send messages to that IP port because it's IP restricted.
So I'll out of IP will in a moment.
Now, while this search server is not set up with username and password or even HTP, is there anything
that could change that if I wanted to?
Now, these processes here, I'm not using those things, so I'm just going to comment those out, but
you can leave that if you want or you can comment about the whole lot.
You can experiment with that you like, but I'm going to turn them all off just to see what happens.
I mean, that is all good now if I look at this in more detail, what is actually happening in this?
File here.
When it opens up, it's looking for the modules in path config modules D Y amount, so control X to
save what I have.
Yes.
And Ellis oh there's the module D older there that's go into that modules D, lists H, and we can say
these are the actual Y emails for each of the modules and they're all disabled.
But if I look at system down there, it doesn't have disabled after it.
We can actually inspect what's in that voicemail or any other just by typing cat system or email.
And that's the Y Amelle.
That's it.
That's just saying module system sist log enable.
True.
And you can look at each of those module files if you want to learn more about those.
But this is not a course on ElasticSearch or Volbeat really.
I'm just showing you how to quickly set it up.
Now let's start Volbeat.
And I can check his status very good.
That's likely not sending data to ElasticSearch servers because IP restricted, so.
Let's just see whether I can reach that despite by using a telnet, so telnet nine 200 trying in, that
will just time out eventually.
Because this server is unable to connect at Port nine 200.
I'm just using Tonette just to verify if I can connect to the poor or not.
OK, so that has timed out and able to connect to remote house.
So let's log on to the basic search server and I'm going to list all IP tables rules and insert a new
rule for my other server.
This one just is a code.
So copy that.
IP tables, line numbers.
I go and I'm going to insert a new rule here, a position to for my ISP code post.
Copy that.
They are happy tables, source IP will be that way.
Let's double check that again and there we go.
I'm accepting messages to Port nine 200 from Espie code on.
Let's just telnet again from the other server just to see just to verify that telnet can connect.
There we go next.
So I can just get out of that by pressing to see.
There we go.
Excellent.
That should now be sending information off to my best search service.
So there we go.
The Volbeat process is now running on my code server, sending off data about system logs to the elasticsearch
server.
Let's configure ElasticSearch data source down there.
So let's go into data sources ElasticSearch.
Now, I have to tell ElasticSearch to look at a new index for Volbeat, or I could create a new data
source completely in the existing index, one that I set up in the last video.
But to know what name the index is going to be, go on to ElasticSearch Server, which is this one here.
And we need to look at the catalog again of indexes.
So that was up here.
OK, cat indices.
And it showed me this index, one which I credit the last video, and then there's the new fall beat,
seven, 10 with today's date now for the index, I can just use Volbeat seven dot star or 10 dot star.
So I'll just demonstrate that.
So I'm replacing this index here with Volbeat 10 dot star.
The field nine time stamp is already correct in the Folbigg index.
So that's good.
So scientist go index.
Okay, let's now go to the explorative and we're looking at the count of system dialogues now from my
S.P. card server.
I look at raw data.
We can see fall.
That's the index agent, Eisenheim Espie code, the nationwide agent type Volbeat.
System event data set systems to slog and event module system.
There's a lot of information.
OK, so let's just try a query on that, so let's filter by process, name by process name.
Kolan system.
The NASA shamy the system day process.
So anyway, there is just an enormous amount of data in there that you can look at.
About age 11 and how many happened and the counts.
OK, now I've only set up Falbe on one server there I speak, but I can set it up on multiple servers
and they would all come through as showing a different host down here, hostname, for example, so
we could do a search on that.
The host name ISP code, and they're all ISP code already, so there was no difference.
Also, you have the option to set tags.
If you wanted to use tags, you can edit the file based email, scroll down to the tags section.
OK, here it is.
So tax tax service name, Web, Teare, whatever you want, I'm going to say my that describes one of
my service.
You could be saying anything.
You like that string, however you think you want to logically order your service, Web service, database
service, anything you like.
My example, tag exit is restart Volbeat.
Remember, if you make any changes to module's or the webmail, restart Volbeat.
OK, very good.
Now, back in Ghafar, after 10 seconds or so, there'll be a new field for tag that we can search for,
see what it's called.
There we go.
Takes my example tag so you can have multiple Volbeat or with different tags and you can just filter
or Istar, for example.
That will show me everything.
For my example tag, I ask you, Will, it's another example.
I don't have anything with Tag Mosque or even with a name like you only have one falbe service set up.
But anyway, hopefully you get the idea.
Now also the datasource there, I just reconfigured an existing data source and changed the index name
and it just so happened at the same time.
Field name.
But you could also write a novel, a data source, ElasticSearch ElasticSearch.
This is my original one scientist.
There we go.
Version seven, excellent.
And now when I explore, I have to elasticsearch.
Data sources to choose from.
So excellent.
And remember, if you made changes, you IP tables, rules on your server should persist.
So on my ElasticSearch server, I'm just going to persist those IP tables rules just in case I do a
reboot.
OK, so that's how to use Falbe as a collector and then rate it through the ElasticSearch datasource
in Gravagna.
Excellent.
In the next video we'll look at Metrick and all install that on a window sized.