Page History

instances:
- name: node1
  dns: wifimon-node1.rashexample.alorg
  ip: 10.254.24.230
- name: node2
  dns: wifimon-node2.rashexample.alorg
  ip: 10.254.24.232
- name: node3
  dns: wifimon-node3.rashexample.alorg
  ip: 10.254.24.237
- name: kibana
  dns: wifimon-kibana.rashexample.alorg
  ip: 10.254.24.148
- name: logstash
  dns: wifimon-logstash.rashexample.alorg
- name: filebeat

/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto -u "https://wifimon-kibana.rashexample.alorg:9200"

curl -XGET --cacert /etc/elasticsearch/certs/ca.crt --user elastic 'https://wifimon-kibana.rashexample.alorg:9200/_cat/nodes?v'

curl --cacert /etc/elasticsearch/certs/ca.crt --user elastic -XGET 'https://wifimon-kibana.rashexample.alorg:9200/_cat/master?v'

curl -XGET --cacert /etc/elasticsearch/certs/ca.crt --user elastic 'https://wifimon-kibana.rashexample.alorg:9200/_cat/health?v'

Sun Mar 10 08:16:05 2019
    Service-Type = Framed-User
    NAS-Port-Id = "wlan2"
    NAS-Port-Type = Wireless-802.11
    User-Name = "sgjeci@rashsgjeci@example.alorg"
    Acct-Session-Id = "82c000cd"
    Acct-Multi-Session-Id = "CC-2D-E0-9A-EB-A3-88-75-98-6C-31-AA-82-C0-00-00-00-00-00-CD"
    Calling-Station-Id = "88-75-98-6C-31-AA"
    Called-Station-Id = "CC-2D-E0-9A-EB-A3:eduroam"
    Acct-Authentic = RADIUS
    Acct-Status-Type = Start
    NAS-Identifier = "Eduroam"
    Acct-Delay-Time = 0
    NAS-IP-Address = 192.168.192.111
    Event-Timestamp = "Mar 8 2019 08:16:05 CET"
    Tmp-String-9 = "ai:"
    Acct-Unique-Session-Id = "e5450a4e16d951436a7c241eaf788f9b"
    Realm = "rashexample.alorg"
    Timestamp = 1552029365

{"@timestamp":"2020-06-28T13:07:37.183Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.8.0"},"logtype":"radius","message":"Sun Mar 10 08:16:05 2019\n\tService-Type = Framed-User\n\tNAS-Port-Id = \"wlan2\"\n\tNAS-Port-Type = Wireless-802.11\n\tUser-Name = \"sgjeci@rashsgjeci@example.alorg\"\n\tAcct-SessionId = \"82c000cd\"\n\tAcct-Multi-Session-Id = \"CC-2D-E0-9A-EB-A3-88-75-98-6C-31-AA82-C0-00-00-00-00-00-CD\"\n\tCalling-Station-Id = \"88-75-98-6C-31-AA\"\n\tCalledStation-Id = \"CC-2D-E0-9A-EB-A3:eduroam\"\n\tAcct-Authentic = RADIUS\n\tAcctStatus-Type = Start\n\tNAS-Identifier = \"Eduroam\"\n\tAcct-Delay-Time = 0\n\tNASIP-Address = 192.168.0.22\n\tEvent-Timestamp = \"Mar 8 2019 08:16:05 CET\"\n\tTmpString-9 = \"ai:\"\n\tAcct-Unique-Session-Id = \"e5450a4e16d951436a7c241eaf788f9b\"\n\tRealm = \"rashexample.alorg\"\n\tTimestamp = 1552029365"}

output.logstash:
  hosts: ["wifimon-logstash.rashexample.alorg:5044"]
  ssl.certificate_authorities: ["/etc/filebeat/certs/ca.crt"]
  ssl.certificate: "/etc/filebeat/certs/filebeat.crt"
  ssl.key: "/etc/filebeat/certs/filebeat.key"
  ssl.key_passphrase: "${key_passphrase}"

set +o history
filebeat setup --index-management \
-E output.logstash.enabled=false \
-E 'output.elasticsearch.hosts=["wifimon-kibana.rashexample.alorg:9200"]' \
-E output.elasticsearch.protocol=https \
-E output.elasticsearch.username=elastic \
-E output.elasticsearch.password=elastic-password-goes-here \
-E 'output.elasticsearch.ssl.certificate_authorities=["/etc/filebeat/certs/
ca.crt"]'
set -o history

monitoring.enabled: true
monitoring.cluster_uuid: "cluster-id-goes-here"
monitoring.elasticsearch.ssl.certificate_authorities: ["/etc/filebeat/certs/ca.crt"]
monitoring.elasticsearch.ssl.certificate: "/etc/filebeat/certs/filebeat.crt"
monitoring.elasticsearch.ssl.key: "/etc/filebeat/certs/filebeat.key"
monitoring.elasticsearch.ssl.key_passphrase: "${key_passphrase}"
monitoring.elasticsearch.hosts: ["https://wifimon-kibana.rashexample.alorg:9200"]
monitoring.elasticsearch.username: beats_system
monitoring.elasticsearch.password: "${beats_system_password}"

curl --cacert /etc/elasticsearch/certs/ca.crt --user elastic -XGET 'https://wifimon-kibana.rashexample.alorg:9200/_cluster/state/all?pretty'

path.data: /var/lib/logstash
path.logs: /var/log/logstash
queue.type: persisted
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "${logstash_system_password}"
xpack.monitoring.elasticsearch.hosts: "https://wifimon-kibana.rashexample.alorg:9200"
xpack.monitoring.elasticsearch.ssl.certificate_authority: "/etc/logstash/certs/ca.crt"
xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
xpack.monitoring.elasticsearch.sniffing: true

curl -X POST --cacert /etc/elasticsearch/certs/ca.crt --user elastic 'https://wifimon-kibana.rashexample.alorg:9200/_security/role/logstash_writer_role?pretty' -H 'Content-Type: application/json' -d'
{
  "cluster": [
    "monitor",
    "manage_index_templates"
  ],
  "indices": [
    {
      "names": [
        "radiuslogs",
        “dhcplogs”
      ],
      "privileges": [
        "write",
        "create_index"
      ],
      "field_security": {
        "grant": [
          "*"
        ]
      }
    }
  ],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}
'

set +o history
curl -X POST --cacert /etc/elasticsearch/certs/ca.crt --user elastic 'https://wifimon-kibana.rashexample.alorg:9200/_security/user/logstash_writer?pretty' -H 'Content-Type: application/json' -d'
{
  "username": "logstash_writer",
  "roles": ["logstash_writer_role"],
  "full_name": null,
  "email": null,
  "password": "some-password-goes-here",
  "enabled": true
}
'
set -o history

output {
    elasticsearch {
        ssl => true
        ssl_certificate_verification => true
        cacert => "/etc/logstash/certs/ca.crt"
        user => "logstash_writer"
        password => "${logstash_writer_password}"
        hosts => ["https://wifimon-kibana.rashexample.alorg"]
        index => "radiuslogs"
    }
}

output {
    elasticsearch {
        ssl => true
        ssl_certificate_verification => true
        cacert => "/etc/logstash/certs/ca.crt"
        user => "logstash_writer"
        password => "${logstash_writer_password}"
        hosts => ["https://wifimon-kibana.rashexample.alorg"]
        index => "dhcplogs"
    }
}

curl -XGET --cacert /etc/elasticsearch/certs/ca.crt --user elastic 'https://wifimon-kibana.rashexample.alorg:9200/_cat/indices/radiuslogs?v'
curl -XGET --cacert /etc/elasticsearch/certs/ca.crt --user elastic 'https://wifimon-kibana.rashexample.alorg:9200/_cat/indices/dhcplogs?v'

curl -X PUT --cacert /etc/elasticsearch/certs/ca.crt --user elastic "https://wifimon-kibana.rashexample.alorg:9200/_ilm/policy/wifimon_policy?pretty" -H 'Content-Type: application/json' -d'
{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "1d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}
'

curl -XGET --cacert /etc/elasticsearch/certs/ca.crt --user elastic "https://wifimon-kibana.rashexample.alorg:9200/_ilm/policy/wifimon_policy?pretty"

 curl -X PUT --cacert /etc/elasticsearch/certs/ca.crt --user elastic "https://wifimon-kibana.rashexample.alorg:9200/_template/wifimon_template?pretty" -H 'Content-Type: application/json' -d'
{
  "index_patterns": ["radiuslogs", “dhcplogs”],
  "settings": {"index.lifecycle.name": "wifimon_policy"}
}
'

curl -XGET --cacert /etc/elasticsearch/certs/ca.crt --user elastic "https://wifimon-kibana.rashexample.alorg:9200/_template/wifimon_template?pretty"

output {
    elasticsearch {
        ssl => true
        cacert => "/etc/logstash/certs/ca.crt"
        ssl_certificate_verification => true
        user => "logstash_writer"
        password => "${logstash_writer_password}"
        hosts => ["https://wifimon-kibana.rashexample.alorg"]
        ilm_enabled => true
        ilm_policy => "wifimon_policy"
        index => "radiuslogs"
    }
}

output {
    elasticsearch {
        ssl => true
        cacert => "/etc/logstash/certs/ca.crt"
        ssl_certificate_verification => true
        user => "logstash_writer"
        password => "${logstash_writer_password}"
        hosts => ["https://wifimon-kibana.rashexample.alorg"]
        ilm_enabled => true
        ilm_policy => "wifimon_policy"
        index => "dhcplogs"
    }
}