- Packetbeat Reference: other versions:
- Overview
- Getting started with Packetbeat
- Setting up and running Packetbeat
- Upgrading Packetbeat
- Configuring Packetbeat
- Set traffic capturing options
- Set up flows to monitor network traffic
- Specify which transaction protocols to monitor
- Specify which processes to monitor
- Specify general settings
- Configure the internal queue
- Configure the output
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Export GeoIP Information
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- HTTP Endpoint
- packetbeat.reference.yml
- Exported fields
- AMQP fields
- Beat fields
- Cassandra fields
- Cloud provider metadata fields
- Common fields
- DHCPv4 fields
- DNS fields
- Docker fields
- Flow Event fields
- Host fields
- HTTP fields
- ICMP fields
- Kubernetes fields
- Memcache fields
- MongoDb fields
- MySQL fields
- NFS fields
- PostgreSQL fields
- Raw fields
- Redis fields
- Thrift-RPC fields
- TLS fields
- Transaction Event fields
- Measurements (Transactions) fields
- Monitoring Packetbeat
- Securing Packetbeat
- Visualizing Packetbeat data in Kibana
- Troubleshooting
- Contributing to Beats
Step 4: Set up the Kibana dashboards
editStep 4: Set up the Kibana dashboards
editPacketbeat comes packaged with example Kibana dashboards, visualizations,
and searches for visualizing Packetbeat data in Kibana. Before you can use
the dashboards, you need to create the index pattern, packetbeat-*, and
load the dashboards into Kibana. To do this, you can either run the setup
command (as described here) or
configure dashboard loading in the
packetbeat.yml config file.
This requires a Kibana endpoint configuration. If you didn’t already configure a Kibana endpoint, see configure Packetbeat.
Make sure Kibana is running before you perform this step. If you are accessing a secured Kibana instance, make sure you’ve configured credentials as described in Step 2: Configure Packetbeat.
To set up the Kibana dashboards for Packetbeat, use the appropriate command for your system. The command shown here loads the dashboards from the Packetbeat package. For more options, such as loading customized dashboards, see Importing Existing Beat Dashboards in the Beats Developer Guide. If you’ve configured the Logstash output, see Set up dashboards for Logstash output.
Use sudo to run these commands if the config file is owned by root.
deb and rpm:
packetbeat setup --dashboards
mac:
./packetbeat setup --dashboards
linux:
./packetbeat setup --dashboards
docker:
docker run --net="host" docker.elastic.co/beats/packetbeat:6.5.4 setup --dashboards
win:
Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).
From the PowerShell prompt, change to the directory where you installed Packetbeat, and run:
PS > .\packetbeat.exe setup --dashboards
Set up dashboards for Logstash output
editDuring dashboard loading, Packetbeat connects to Elasticsearch to check version information. To load dashboards when the Logstash output is enabled, you need to temporarily disable the Logstash output and enable Elasticsearch. To connect to a secured Elasticsearch cluster, you also need to pass Elasticsearch credentials.
The example shows a hard-coded password, but you should store sensitive values in the secrets keystore.
deb and rpm:
packetbeat setup -e \ -E output.logstash.enabled=false \ -E output.elasticsearch.hosts=['localhost:9200'] \ -E output.elasticsearch.username=packetbeat_internal \ -E output.elasticsearch.password=YOUR_PASSWORD \ -E setup.kibana.host=localhost:5601
mac:
./packetbeat setup -e \ -E output.logstash.enabled=false \ -E output.elasticsearch.hosts=['localhost:9200'] \ -E output.elasticsearch.username=packetbeat_internal \ -E output.elasticsearch.password=YOUR_PASSWORD \ -E setup.kibana.host=localhost:5601
linux:
./packetbeat setup -e \ -E output.logstash.enabled=false \ -E output.elasticsearch.hosts=['localhost:9200'] \ -E output.elasticsearch.username=packetbeat_internal \ -E output.elasticsearch.password=YOUR_PASSWORD \ -E setup.kibana.host=localhost:5601
docker:
docker run --net="host" docker.elastic.co/beats/packetbeat:6.5.4 setup -e \ -E output.logstash.enabled=false \ -E output.elasticsearch.hosts=['localhost:9200'] \ -E output.elasticsearch.username=packetbeat_internal \ -E output.elasticsearch.password=YOUR_PASSWORD \ -E setup.kibana.host=localhost:5601
win:
Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).
From the PowerShell prompt, change to the directory where you installed Packetbeat, and run:
PS > .\packetbeat.exe setup -e ` -E output.logstash.enabled=false ` -E output.elasticsearch.hosts=['localhost:9200'] ` -E output.elasticsearch.username=packetbeat_internal ` -E output.elasticsearch.password=YOUR_PASSWORD ` -E setup.kibana.host=localhost:5601
On this page