My name is Ali, I am a Network Analyst. I love learning networking technologies and sharing what I learn with the IT community. I earned a couple of Cisco CCNA certificates, Fortinet NSE4, and am currently working on my CCNP studies and network automation with Python. In this channel, I share what I learn and try to explain things that gave me a hard time so you don't struggle as much 😄
Hi Ali, fantastic video - works like a charm. Thx for the effort. I have one or two questions regarding adding additional containers to the docker-compose file. If i add additional containers, i get the following error, validating /home/test/elk/docker-compose.yml: services.logstash Additional property filebeat is not allowed. Can file beat just be added as a separate container instead of adding it to the docker-compose file?
You can add it as a separate container, but I think the error is because Filebeat has to be on the same level as Logstash under the "services" key in the docker-compose.yml file.
Yes you can send to Logstash without Filebeat. I have this tutorial explaining how to install Logstash and send Fortigate logs to it: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-Tp5dI-GDerM.htmlsi=9XJLRCBk_R91-BZk
I almost gave up installing ELK 8. Thank you very much for the straight and forward video. The only difference I have to make is setting cluster name and keeping the node-name disabled. Much respect
Hey, I was able to download and setup filebeat and it showed me that kibana dashboard must be running and reachable but when I refresh the page the logs section shows me that I still need to install filebeat which I have already done
Hi Ali, Do you think ElasticSearch can be used for documents archiving and records management. I work for engineering company where project can produce 10s of thousands of documents . All those need to be archived provided retention schedule before records\files are destroyed (deleted from they system with log documenting the destruction event).
I run your docker-compose file but get this error in Kinaba: FATAL Error: [config validation of [xpack.encryptedSavedObjects].encryptionKey]: value has length [16] but it must have a minimum length of [32].
MAD RESPECT!! Clear explanations, well-paced tutorials, and incredibly useful content. Big props to you Ali for making complex topics so accessible and engaging. waiting for more about elastic stack kafka, load balancing, reverse proxies, integration with TheHive, Cortex... Keep up the fantastic work may Allah bless you! ❤🙏
my logstash cannot conect to elastic.. i already put in false the security... logs in logstash are like this: [2024-06-07T08:06:29,273][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
Thank you very much for your great tutorial. Even if the Elastic documentation explains similar steps but there were many steps not working, but you shown them practically.
i have error : org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:808) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:767) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/en vironment.rb:90) ~[?:?]
Nice Vid Ali. I've installed Fleet and some Integrations. But when I try a CISCO FTD, the installation gets completed, No errors observed. Yet the Data Streams are not created. Any suggestion? I am supposed to receive the logs into a Ingestion Server with the Elastic Agent installed and the FTD sends the logs to the Ingestion server. In my integration I am using the IP address of the Ingestion server port 9003. The Ingestion server windows firewall has the UDP port opened. All this is on Windows btw. I use the same Agent policy for both the Windows OS and the Cisco devices. I tried to create a new Cisco policy to separate the logs, but then it tries to install the Agent on the Ingestion server which has the Elastic Agent already installed for the other Integrations. I even changed the Namespace on the Integration settings to user other name than "default" and eve tried with "default". Same results whatsoever. Thanks for your help if at all possible.
We just moved from a pfsense netgate + dell switch setup to a full 2x fortigate 100f in HA + 3 stacked Fortiswitches so, trying to learn as much as I can about this environment.
I have errors: "stacktrace": ["java.net.UnknownHostException: es01" "stacktrace": ["java.net.UnknownHostException: es02" "stacktrace": ["java.net.UnknownHostException: es03" Help me please!
