User's Guide

Part 1 – Installing and Configuring ElastiFlow and Elastic Stack
210 of 218
sudo systemctl restart kibana
The default port for the Kibana’s server is tcp port 5601. Create a
firewall rule to allow users access to the Kibana server. The rule should
be something like:
sudo ufw allow from YOUR_MANAGEMENT_SUBNET to any port 5601
proto tcp
c. Configure Logstash:
Edit JVM setting in /etc/logstash/jvm.options.
sudo nano /etc/logstash/jvm.options
Change -Xms1g to -Xms4g.
Change -Xmx1g to -Xmx4g.
Save the file.
Add required Logstash plugins.
sudo /usr/share/logstash/bin/logstash-plugin update
logstash-codec-netflow;
sudo /usr/share/logstash/bin/logstash-plugin update
logstash-input-udp;
sudo /usr/share/logstash/bin/logstash-plugin update
logstash-filter-dns;
sudo /usr/share/logstash/bin/logstash-plugin update
logstash-filter-geoip;
sudo /usr/share/logstash/bin/logstash-plugin update
logstash-filter-translate
4. Download and extract ElastiFlow v3.4.2.tar.gz to /usr/local/src.
wget
https://github.com/robcowart/elastiflow/archive/v3.4.2.tar.gz
sudo tar xvzf v3.4.2.tar.gz -C /usr/local/src
5. Copy logstash configuration.
cd /usr/local/src
sudo cp -arv elastiflow-3.4.2/logstash/elastiflow/.
/etc/logstash/elastiflow
6. Merge Extreme Networks specific IPFIX definitions with ElastiFlow.