How To install Filebeat on FreeBSD

[Datorresp]

Hey everyone,

guys, I need integrate Suricata in my elk dashboards, but Suricata is in a pfsense firewall on FreeBSD, I have been looking for how to install filebeat to be able to integrate with the ELK but nothing works. I found information from 2016 and all packages and ports doesn't work now. Also in elastic's web page, in filebeat instalation, there isn't download option for FreeBSD

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[tarkhil]

I have installed filebeat from ports sysutils/beats7 and have some troubles

There is no suricata module in setup, I've extracted it from darwin archive and ...

... well, chown everything to root (chown -R root /usr/local/share/beats/filebeat/module/suricata/ /usr/local/etc/beats/filebeat.modules.d/suricata.yml) and it's running.

I have to make some visualization, set up ILM, but that's all ... sorry, not all.

2021-01-07T20:54:32.495+0300    ERROR   instance/metrics.go:98  Error while getting memory usage: error retrieving process stats: cannot find matching process for pid=27000
2021-01-07T20:54:32.496+0300    ERROR   instance/metrics.go:142 Error retrieving CPU percentages: error retrieving process stats: cannot find matching process for pid=27000
2021-01-07T20:54:32.496+0300    ERROR   instance/metrics_file_descriptors.go:39 Error while retrieving FD information: error retrieving process stats: cannot find matching process for pid=27000
2021-01-07T20:54:32.496+0300    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"info":{"ephemeral_id":"a4464c66-d73f-4b83-90f7-5660668b113b","uptime":{"ms":150051}},"memstats":{"gc_next":124920352,"memory_alloc":81098976,"memory_total":518873712},"runtime":{"goroutines":31}},"filebeat":{"events":{"added":2098,"done":2098},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":2098,"batches":42,"total":2098},"read":{"bytes":28066},"write":{"bytes":4207826}},"pipeline":{"clients":1,"events":{"active":4117,"published":2098,"total":2098},"queue":{"acked":2098}}},"registrar":{"states":{"current":1,"update":2098},"writes":{"success":42,"total":42}},"system":{"load":{"1":0,"15":0,"5":0,"norm":{"1":0,"15":0,"5":0}}}}}}

I'll think of it, most likely tomorrow

[imightbelosthere]

Did this "died"? I mean... on ELK stack we have the suricata integration but there's no support at all on how to integrate and grab the logs from a platform that has suricata in it?

Think I'll just ship all the logs to Azure Log Analytics then...

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[ph]

closing in favor of #1034