{"id":350,"date":"2020-02-01T23:07:33","date_gmt":"2020-02-02T04:07:33","guid":{"rendered":"https:\/\/snehpatel.com\/?p=350"},"modified":"2020-02-01T23:07:33","modified_gmt":"2020-02-02T04:07:33","slug":"installation-of-pfelk-on-ubuntu-elk-for-pfsense","status":"publish","type":"post","link":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/","title":{"rendered":"Installation of PFELK on ubuntu. ELK for pfSense"},"content":{"rendered":"\n<p>As&nbsp;per&nbsp;my&nbsp;promise&nbsp;or&nbsp;I&nbsp;can&nbsp;say&nbsp;mention&nbsp;of&nbsp;pfSense&nbsp;installation&nbsp;I&nbsp;am&nbsp;presenting&nbsp;the&nbsp;installation&nbsp;guide.&nbsp;By&nbsp;the&nbsp;way,&nbsp;I&nbsp;just&nbsp;copied&nbsp;every&nbsp;step&nbsp;from&nbsp;the&nbsp;GitHub&nbsp;repository&nbsp;document&nbsp;if&nbsp;anyone&nbsp;is wondering. Steps&nbsp;given&nbsp;in&nbsp;the&nbsp;official&nbsp;documentation&nbsp;are&nbsp;perfect&nbsp;and&nbsp;straight&nbsp;forward.&nbsp;I&nbsp;honestly&nbsp;rewrote&nbsp;it&nbsp;because&nbsp;I&nbsp;was&nbsp;running&nbsp;out&nbsp;of&nbsp;ideas&nbsp;and&nbsp;I&nbsp;promised&nbsp;it&nbsp;in&nbsp;the previous&nbsp;post.&nbsp;<\/p>\n\n\n\n<p>But&nbsp;one&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;that&nbsp;if&nbsp;you&nbsp;are&nbsp;a beginner like me don&#8217;t use scripted install, do it manually. It is good to know what components are being installed to get it done. <\/p>\n\n\n\n<p>The&nbsp;one&nbsp;important&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;about&nbsp;ELK&nbsp;(btw,&nbsp;I&nbsp;have&nbsp;told&nbsp;this&nbsp;many&nbsp;times&nbsp;before&nbsp;but&nbsp;I need&nbsp;content,&nbsp;JK&nbsp;;))&nbsp;is&nbsp;that&nbsp;it&nbsp;is&nbsp;a&nbsp;base&nbsp;for&nbsp;so&nbsp;many&nbsp;SIEM&nbsp;and&nbsp;cannot&nbsp;be&nbsp;neglected&nbsp;from&nbsp;learning it&nbsp;from&nbsp;the base. You can customize it so much to basically make it look like you :). Now enough of these fillers let&#8217;s get straight into the content.<\/p>\n\n\n\n<p> Note:&nbsp;This&nbsp;is&nbsp;tested&nbsp;in&nbsp;ubuntu<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li> Let&#8217;s&nbsp;add&nbsp;Oracle&nbsp;Java&nbsp;Repository <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo add-apt-repository ppa:linuxuprising\/java<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Adding&nbsp;Maxmind&nbsp;repository <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo add-apt-repository ppa:maxmind\/ppa<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Download&nbsp;and&nbsp;install&nbsp;the&nbsp;public&nbsp;GPG&nbsp;signing&nbsp;key <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo apt-key add -<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Install&nbsp;apt-transport-https&nbsp;package <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get install apt-transport-https<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Add&nbsp;ELK&nbsp;repository<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main\" | sudo tee -a \/etc\/apt\/sources.list.d\/elastic-7.x.list<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Update&nbsp;the&nbsp;repository <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get update<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Install&nbsp;Java&nbsp;13 <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get install oracle-java13-installer<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Install&nbsp;Maxmind&nbsp;GeoIP&nbsp;database&nbsp;provider&nbsp;package <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install geoipupdate<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Configuring&nbsp;Maxmind <ul><li>Create Maxmind account by going to following link https:\/\/www.maxmind.com\/en\/geolite2\/signup<\/li><li>Login to your Max Mind Account; navigate to &#8220;My License Key&#8221; under &#8220;Services&#8221; and Generate new license key<ul><li> If&nbsp;asked&nbsp;create&nbsp;a config&nbsp;file.&nbsp;Select&nbsp;one&nbsp;that&nbsp;will&nbsp;create&nbsp;one. <\/li><\/ul><\/li><\/ul><\/li><li> Now&nbsp;edit&nbsp;the&nbsp;config&nbsp;file&nbsp;for&nbsp;max&nbsp;mind <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/GeoIP.conf<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Modify&nbsp;lines&nbsp;7&nbsp;&amp;&nbsp;8&nbsp;as&nbsp;follows&nbsp;(Replace&nbsp;000&nbsp;with&nbsp;your&nbsp;number) <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>AccountID 0000\nLicenseKey 0000<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Modify&nbsp;line&nbsp;13&nbsp;as&nbsp;follows <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>EditionIDs GeoLite2-City GeoLite2-Country GeoLite2-ASN<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Download&nbsp;the&nbsp;GeoIP&nbsp;database <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo geoipupdate -d \/usr\/share\/GeoIP\/<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Add&nbsp;cron&nbsp;job&nbsp;to&nbsp;update&nbsp;GeoIP&nbsp;database <ul><li> Create&nbsp;a new&nbsp;cron&nbsp;job&nbsp;file <\/li><\/ul><\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/cron.weekly\/geoipupdate<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Add&nbsp;following&nbsp;line&nbsp;into&nbsp;the&nbsp;file <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>0 1 * * * geoipupdate -d \/usr\/share\/GeoIP<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Let&#8217;s&nbsp;get&nbsp;to&nbsp;the installation&nbsp;of&nbsp;ElasticStack <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get install elasticsearch &amp;&amp; sudo apt-get install kibana &amp;&amp; sudo apt-get install logstash<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Edit&nbsp;Kibana&nbsp;Configuration <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/kibana\/kibana.yml<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Modify&nbsp;the following&nbsp;items <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>server.port: 5601\nserver.host: \"0.0.0.0\"<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Change&nbsp;the&nbsp;directory&nbsp;add&nbsp;logstash&nbsp;configuration <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/etc\/logstash\/conf.d<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Download&nbsp;configuration&nbsp;files&nbsp;for&nbsp;logstash&nbsp;parsing&nbsp;and&nbsp;filtering <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/01-inputs.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/05-firewall.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/30-geoip.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/50-outputs.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/10-others.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/20-suricata.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/25-snort.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/35-rules-desc.conf\nsudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/45-cleanup.conf<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Make new patterns folder and navigate<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo mkdir \/etc\/logstash\/conf.d\/patterns\ncd \/etc\/logstash\/conf.d\/patterns\/<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Download&nbsp;pattern&nbsp;config&nbsp;file <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo wget https:\/\/raw.githubusercontent.com\/3ilson\/pfelk\/master\/etc\/logstash\/conf.d\/patterns\/pfelk.grok<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Get&nbsp;back&nbsp;to&nbsp;the previous&nbsp;folder&nbsp;and&nbsp;open&nbsp;01-inputs.conf&nbsp;file&nbsp;in&nbsp;a text&nbsp;editor <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ..\nnano 01-inputs.conf<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Edit&nbsp;the following&nbsp;things in the file<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>Change line 9; the \"if &#91;host] =~ ...\" should point to your pfSense\/OPNsense IP address\nChange line 12-16; (OPTIONAL) to point to your second PF IP address or ignore\n\nIf you are using pfSense uncommit line 28 and commit out line 25\nor if using OPNsense uncommit line 25 and commit out line 28<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Disable Swap to increase performance<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo swapoff -a<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li> Set&nbsp;current&nbsp;time&nbsp;zone <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo timedatectl set-timezone EST<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Configure service to start on boot and restart the services<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/bin\/systemctl daemon-reload\nsudo \/bin\/systemctl enable elasticsearch.service\nsudo \/bin\/systemctl enable kibana.service\nsudo \/bin\/systemctl enable logstash.service\n\nsystemctl start elasticsearch \nsystemctl start kibana \nsystemctl start logstash<\/code><\/pre>\n\n\n\n<p>This was all server-side configuration. Let&#8217;s configure the pfSense firewall<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>In&nbsp;pfSense&nbsp;navigate&nbsp;to&nbsp;Status-&gt;System&nbsp;Logs,&nbsp;then&nbsp;click&nbsp;on&nbsp;Settings. <\/li><li>In OPNsense navigate to System-&gt;Settings-&gt;Logging<\/li><li>At the bottom check &#8220;Enable Remote Logging&#8221;<\/li><li>(Optional) Select a specific interface to use for forwarding<\/li><li>Enter the ELK local IP into the field &#8220;Remote log servers&#8221; with port 5140 (eg 192.168.100.50:5140)<\/li><li>Under &#8220;Remote Syslog Contents&#8221; check &#8220;Everything&#8221;<\/li><li>Click Save<\/li><\/ul>\n\n\n\n<p> Now we need to define index pattern to get the data to in the kibana. It is generally used for the segregation of logs.  <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>In\u00a0your\u00a0web\u00a0browser\u00a0go\u00a0to\u00a0the\u00a0ELK\u00a0local\u00a0IP\u00a0using\u00a0port\u00a05601\u00a0(ex:\u00a0192.168.0.1:5601)<span style=\"font-size: inherit; background-color: initial;\">\u00a0<\/span><\/li><li>Click\u00a0the\u00a0gear\u00a0icon\u00a0(management)\u00a0in\u00a0the\u00a0lower\u00a0left<\/li><li>Click\u00a0Kibana\u00a0->\u00a0Index\u00a0Patters<\/li><li>Click\u00a0Create\u00a0New\u00a0Index\u00a0Pattern<\/li><li>Type\u00a0&#8220;pf-*&#8221;\u00a0into\u00a0the\u00a0input\u00a0box,\u00a0then\u00a0click\u00a0Next\u00a0Step <\/li><li>Now select Timestamp<\/li><\/ul>\n\n\n\n<p>Help on index pattern defining. <a href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/index-patterns.html\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/index-patterns.html<\/a> <\/p>\n\n\n\n<p> You can make your own dashboard as per your needs but you use the following link to get json files to import the dashboard. <a href=\"https:\/\/github.com\/3ilson\/pfelk\/tree\/master\/Dashboard\/v5.5\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/3ilson\/pfelk\/tree\/master\/Dashboard\/v5.5<\/a><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>In&nbsp;your&nbsp;web&nbsp;browser&nbsp;go&nbsp;to&nbsp;the&nbsp;ELK&nbsp;local&nbsp;IP&nbsp;using&nbsp;port&nbsp;5601&nbsp;(ex:&nbsp;192.168.0.1:5601)<\/li><li>Click&nbsp;Management&nbsp;-&gt;&nbsp;Saved&nbsp;Objects<\/li><li>You&nbsp;can&nbsp;import&nbsp;the&nbsp;dashboards&nbsp;found&nbsp;in&nbsp;the&nbsp;Dashboard&nbsp;folder&nbsp;via&nbsp;the&nbsp;Import&nbsp;bottom&nbsp;in the top-right&nbsp;corner. <\/li><\/ul>\n\n\n\n<p>That it, for now, you are ready to use the Elastic stack for pfSense firewall. <\/p>\n\n\n\n<p>All credit:  <a href=\"https:\/\/github.com\/a3ilson\/pfelk\">https:\/\/github.com\/a3ilson\/pfelk<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>As&nbsp;per&nbsp;my&nbsp;promise&nbsp;or&nbsp;I&nbsp;can&nbsp;say&nbsp;mention&nbsp;of&nbsp;pfSense&nbsp;installation&nbsp;I&nbsp;am&nbsp;presenting&nbsp;the&nbsp;installation&nbsp;guide.&nbsp;By&nbsp;the&nbsp;way,&nbsp;I&nbsp;just&nbsp;copied&nbsp;every&nbsp;step&nbsp;from&nbsp;the&nbsp;GitHub&nbsp;repository&nbsp;document&nbsp;if&nbsp;anyone&nbsp;is wondering. Steps&nbsp;given&nbsp;in&nbsp;the&nbsp;official&nbsp;documentation&nbsp;are&nbsp;perfect&nbsp;and&nbsp;straight&nbsp;forward.&nbsp;I&nbsp;honestly&nbsp;rewrote&nbsp;it&nbsp;because&nbsp;I&nbsp;was&nbsp;running&nbsp;out&nbsp;of&nbsp;ideas&nbsp;and&nbsp;I&nbsp;promised&nbsp;it&nbsp;in&nbsp;the previous&nbsp;post.&nbsp; But&nbsp;one&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;that&nbsp;if&nbsp;you&nbsp;are&nbsp;a beginner like me don&#8217;t use scripted install, do it manually. It is good to know what components are being installed to get it done. The&nbsp;one&nbsp;important&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;about&nbsp;ELK&nbsp;(btw,&nbsp;I&nbsp;have&nbsp;told&nbsp;this&nbsp;many&nbsp;times&nbsp;before&nbsp;but&nbsp;I need&nbsp;content,&nbsp;JK&nbsp;;))&nbsp;is&nbsp;that&nbsp;it&nbsp;is&nbsp;a&nbsp;base&nbsp;for&nbsp;so&nbsp;many&nbsp;SIEM&nbsp;and&nbsp;cannot&nbsp;be&nbsp;neglected&nbsp;from&nbsp;learning it&nbsp;from&nbsp;the base. You can customize it so much to basically make it look like you :). Now enough of these fillers let&#8217;s get straight &#8230; <a title=\"Installation of PFELK on ubuntu. ELK for pfSense\" class=\"read-more\" href=\"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/\" aria-label=\"Read more about Installation of PFELK on ubuntu. ELK for pfSense\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,15,3,21],"tags":[27,28,35,44,46],"class_list":["post-350","post","type-post","status-publish","format-standard","hentry","category-elk","category-firewall","category-logging","category-pfsense","tag-elastic","tag-elk","tag-logs","tag-pfelk","tag-pfsense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Installation of PFELK on ubuntu. ELK for pfSense - Sneh Patel<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Installation of PFELK on ubuntu. ELK for pfSense - Sneh Patel\" \/>\n<meta property=\"og:description\" content=\"As&nbsp;per&nbsp;my&nbsp;promise&nbsp;or&nbsp;I&nbsp;can&nbsp;say&nbsp;mention&nbsp;of&nbsp;pfSense&nbsp;installation&nbsp;I&nbsp;am&nbsp;presenting&nbsp;the&nbsp;installation&nbsp;guide.&nbsp;By&nbsp;the&nbsp;way,&nbsp;I&nbsp;just&nbsp;copied&nbsp;every&nbsp;step&nbsp;from&nbsp;the&nbsp;GitHub&nbsp;repository&nbsp;document&nbsp;if&nbsp;anyone&nbsp;is wondering. Steps&nbsp;given&nbsp;in&nbsp;the&nbsp;official&nbsp;documentation&nbsp;are&nbsp;perfect&nbsp;and&nbsp;straight&nbsp;forward.&nbsp;I&nbsp;honestly&nbsp;rewrote&nbsp;it&nbsp;because&nbsp;I&nbsp;was&nbsp;running&nbsp;out&nbsp;of&nbsp;ideas&nbsp;and&nbsp;I&nbsp;promised&nbsp;it&nbsp;in&nbsp;the previous&nbsp;post.&nbsp; But&nbsp;one&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;that&nbsp;if&nbsp;you&nbsp;are&nbsp;a beginner like me don&#8217;t use scripted install, do it manually. It is good to know what components are being installed to get it done. The&nbsp;one&nbsp;important&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;about&nbsp;ELK&nbsp;(btw,&nbsp;I&nbsp;have&nbsp;told&nbsp;this&nbsp;many&nbsp;times&nbsp;before&nbsp;but&nbsp;I need&nbsp;content,&nbsp;JK&nbsp;;))&nbsp;is&nbsp;that&nbsp;it&nbsp;is&nbsp;a&nbsp;base&nbsp;for&nbsp;so&nbsp;many&nbsp;SIEM&nbsp;and&nbsp;cannot&nbsp;be&nbsp;neglected&nbsp;from&nbsp;learning it&nbsp;from&nbsp;the base. You can customize it so much to basically make it look like you :). Now enough of these fillers let&#8217;s get straight ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/\" \/>\n<meta property=\"og:site_name\" content=\"Sneh Patel\" \/>\n<meta property=\"article:published_time\" content=\"2020-02-02T04:07:33+00:00\" \/>\n<meta name=\"author\" content=\"Sneh Patel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sneh Patel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/\"},\"author\":{\"name\":\"Sneh Patel\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"headline\":\"Installation of PFELK on ubuntu. ELK for pfSense\",\"datePublished\":\"2020-02-02T04:07:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/\"},\"wordCount\":904,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"keywords\":[\"elastic\",\"ELK\",\"logging\",\"pfelk\",\"pfsense\"],\"articleSection\":[\"ELK\",\"Firewall\",\"Logging\",\"pfsense\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/\",\"url\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/\",\"name\":\"Installation of PFELK on ubuntu. ELK for pfSense - Sneh Patel\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#website\"},\"datePublished\":\"2020-02-02T04:07:33+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2020\\\/02\\\/01\\\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\\\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#website\",\"url\":\"https:\\\/\\\/snehpatel.com\\\/\",\"name\":\"Sneh Patel\",\"description\":\"Cyber Security Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/snehpatel.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\",\"name\":\"Sneh Patel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"width\":672,\"height\":222,\"caption\":\"Sneh Patel\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\"},\"sameAs\":[\"http:\\\/\\\/snehpatel.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Installation of PFELK on ubuntu. ELK for pfSense - Sneh Patel","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/","og_locale":"en_US","og_type":"article","og_title":"Installation of PFELK on ubuntu. ELK for pfSense - Sneh Patel","og_description":"As&nbsp;per&nbsp;my&nbsp;promise&nbsp;or&nbsp;I&nbsp;can&nbsp;say&nbsp;mention&nbsp;of&nbsp;pfSense&nbsp;installation&nbsp;I&nbsp;am&nbsp;presenting&nbsp;the&nbsp;installation&nbsp;guide.&nbsp;By&nbsp;the&nbsp;way,&nbsp;I&nbsp;just&nbsp;copied&nbsp;every&nbsp;step&nbsp;from&nbsp;the&nbsp;GitHub&nbsp;repository&nbsp;document&nbsp;if&nbsp;anyone&nbsp;is wondering. Steps&nbsp;given&nbsp;in&nbsp;the&nbsp;official&nbsp;documentation&nbsp;are&nbsp;perfect&nbsp;and&nbsp;straight&nbsp;forward.&nbsp;I&nbsp;honestly&nbsp;rewrote&nbsp;it&nbsp;because&nbsp;I&nbsp;was&nbsp;running&nbsp;out&nbsp;of&nbsp;ideas&nbsp;and&nbsp;I&nbsp;promised&nbsp;it&nbsp;in&nbsp;the previous&nbsp;post.&nbsp; But&nbsp;one&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;that&nbsp;if&nbsp;you&nbsp;are&nbsp;a beginner like me don&#8217;t use scripted install, do it manually. It is good to know what components are being installed to get it done. The&nbsp;one&nbsp;important&nbsp;thing&nbsp;I&nbsp;would&nbsp;say&nbsp;about&nbsp;ELK&nbsp;(btw,&nbsp;I&nbsp;have&nbsp;told&nbsp;this&nbsp;many&nbsp;times&nbsp;before&nbsp;but&nbsp;I need&nbsp;content,&nbsp;JK&nbsp;;))&nbsp;is&nbsp;that&nbsp;it&nbsp;is&nbsp;a&nbsp;base&nbsp;for&nbsp;so&nbsp;many&nbsp;SIEM&nbsp;and&nbsp;cannot&nbsp;be&nbsp;neglected&nbsp;from&nbsp;learning it&nbsp;from&nbsp;the base. You can customize it so much to basically make it look like you :). Now enough of these fillers let&#8217;s get straight ... Read more","og_url":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/","og_site_name":"Sneh Patel","article_published_time":"2020-02-02T04:07:33+00:00","author":"Sneh Patel","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sneh Patel","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/#article","isPartOf":{"@id":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/"},"author":{"name":"Sneh Patel","@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"headline":"Installation of PFELK on ubuntu. ELK for pfSense","datePublished":"2020-02-02T04:07:33+00:00","mainEntityOfPage":{"@id":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/"},"wordCount":904,"commentCount":5,"publisher":{"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"keywords":["elastic","ELK","logging","pfelk","pfsense"],"articleSection":["ELK","Firewall","Logging","pfsense"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/","url":"https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/","name":"Installation of PFELK on ubuntu. ELK for pfSense - Sneh Patel","isPartOf":{"@id":"https:\/\/snehpatel.com\/#website"},"datePublished":"2020-02-02T04:07:33+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/snehpatel.com\/index.php\/2020\/02\/01\/installation-of-pfelk-on-ubuntu-elk-for-pfsense\/"]}]},{"@type":"WebSite","@id":"https:\/\/snehpatel.com\/#website","url":"https:\/\/snehpatel.com\/","name":"Sneh Patel","description":"Cyber Security Blog","publisher":{"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/snehpatel.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73","name":"Sneh Patel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","url":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","contentUrl":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","width":672,"height":222,"caption":"Sneh Patel"},"logo":{"@id":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1"},"sameAs":["http:\/\/snehpatel.com"]}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts\/350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/comments?post=350"}],"version-history":[{"count":0,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts\/350\/revisions"}],"wp:attachment":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/media?parent=350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/categories?post=350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/tags?post=350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}